3 ms·

I think if security is a main concern of people working on Linux, there are both lower hanging fruit AND bigger fish to fry than getting code into Rust. Not th

I think if security is a main concern of people working on Linux, there are both lower hanging fruit AND bigger fish to fry than getting code into Rust. Not that it isn't a worthy effort, but it's still an effort by people who are more excited about Rust than they are acting in the interest of security. Edit: It's almost a meme at this point that you can't even be remotely critical of Rust on this board without kneejerk mass downvoting.

steveklabnik 6y ago
Do you know anything about the people whose motives you are questioning? What work they've done, and why? I think if you did, you may not say what you've said.
- busterarm 6y ago
  I'm well aware of whom I'm speaking to and the efforts made by others. I'm also well aware of lots of other security problems facing Linux that need love and the steps being taken by other operating systems where Linux lags behind. So while I'm not saying that there isn't a concern about security by the people involved, I am certainly saying why this as opposed to other things. I have my pet problems and areas where I prefer to work too.
pdimitar 6y ago
> there are both lower hanging fruit AND bigger fish to fry than getting code into Rust. Do tell, I am very interested? > but it's still an effort by people who are more excited about Rust than they are acting in the interest of security Needlessly dismissive. What if the people got excited because of the increased security?
- busterarm 6y ago
  > Needlessly dismissive. What if the people got excited because of the increased security? If only people were so excited about making OpenSSL not a flaming hot bag of shit. Can't wait to find out what that patch on Thursday will be for.
  - pdimitar 6y ago
    I don't see how that overlaps with many of us, myself included. My 19 years of programming have taught me that something that continuously craps the bed (like OpenSSL) needs to be rewritten because from one point and on it's clear that the cost of maintenance exceeds the cost of rewriting. Furthermore, do consider that some of us were programming C and C++ and found them sub-optimal. But here we would likely venture into language wars because there are a lot of programmers like myself out there who will never subscribe under the notion of "C is fine, you are just doing it wrong".
    - busterarm 6y ago
      > My 19 years of programming have taught me that something that continuously craps the bed (like OpenSSL) needs to be rewritten because from one point and on it's clear that the cost of maintenance exceeds the cost of rewriting. I would agree and it was already done by the OpenBSD project. Google started BoringSSL/Tink. Amazon created s2n. Linux continues to use OpenSSL. It's still probably in the top 3 problems with security in Linux that needs fixing. The rest of your statement is just making my point for me.
      - pdimitar 6y ago
        Well, in that case your statement of "If only people were so excited about making OpenSSL not a flaming hot bag of shit" is severely misplaced. I have no influence over Linux governance. 99.9999% of us out there don't have that influence. So what was your point exactly? Rants are fine and we all do them but I will strongly disagree with any responsibility or guilt transferred to me because I am excited about Rust and not about OpenSSL. As you yourself pointed out, alternatives exist but aren't adopted so the problem is political and not technical. Right? > The rest of your statement is just making my point for me. Not sure what you mean but okay. ¯\_(ツ)_/¯
        busterarm 6y ago
        > Furthermore, do consider that some of us were programming C and C++ and found them sub-optimal. But here we would likely venture into language wars because there are a lot of programmers like myself out there who will never subscribe under the notion of "C is fine, you are just doing it wrong". > Not sure what you mean but okay. ¯\_(ツ)_/¯ Blame the carpenter, not the tools. C or C++ isn't a real business problem domain that anyone has. Nobody's committing their budget to fix that. That's the kind of problem only held by ideologues and other unreasonable people. My point was that people who care about fixing problems in the security domain will look to fix the biggest problems they can in the security domain. They won't look at it and say "no, I can't fix this because C/C++ is unacceptable to me." That's someone who cares more about the tools than the problem domain. Whethor or not you think C/C++ are suitable to the problem domain of writing secure software, software will be written in C/C++ and must be secured. Turn down work all you want though. More for the rest of us.
mlindner 6y ago
> Edit: It's almost a meme at this point that you can't even be remotely critical of Rust on this board without kneejerk mass downvoting. I do wonder how it happens as I upvote such people, but I've been posting here for years and still don't have downvote privileges. I do wonder sometimes who controls the downvotes.
- busterarm 6y ago
  It's gated behind a karma score threshold.

steveklabnik 6y ago

Do you know anything about the people whose motives you are questioning? What work they've done, and why? I think if you did, you may not say what you've said.

busterarm 6y ago
I'm well aware of whom I'm speaking to and the efforts made by others. I'm also well aware of lots of other security problems facing Linux that need love and the steps being taken by other operating systems where Linux lags behind. So while I'm not saying that there isn't a concern about security by the people involved, I am certainly saying why this as opposed to other things. I have my pet problems and areas where I prefer to work too.

pdimitar 6y ago

> there are both lower hanging fruit AND bigger fish to fry than getting code into Rust. Do tell, I am very interested? > but it's still an effort by people who are more excited about Rust than they are acting in the interest of security Needlessly dismissive. What if the people got excited because of the increased security?

busterarm 6y ago
> Needlessly dismissive. What if the people got excited because of the increased security? If only people were so excited about making OpenSSL not a flaming hot bag of shit. Can't wait to find out what that patch on Thursday will be for.
- pdimitar 6y ago
  I don't see how that overlaps with many of us, myself included. My 19 years of programming have taught me that something that continuously craps the bed (like OpenSSL) needs to be rewritten because from one point and on it's clear that the cost of maintenance exceeds the cost of rewriting. Furthermore, do consider that some of us were programming C and C++ and found them sub-optimal. But here we would likely venture into language wars because there are a lot of programmers like myself out there who will never subscribe under the notion of "C is fine, you are just doing it wrong".
  - busterarm 6y ago
    > My 19 years of programming have taught me that something that continuously craps the bed (like OpenSSL) needs to be rewritten because from one point and on it's clear that the cost of maintenance exceeds the cost of rewriting. I would agree and it was already done by the OpenBSD project. Google started BoringSSL/Tink. Amazon created s2n. Linux continues to use OpenSSL. It's still probably in the top 3 problems with security in Linux that needs fixing. The rest of your statement is just making my point for me.
    - pdimitar 6y ago
      Well, in that case your statement of "If only people were so excited about making OpenSSL not a flaming hot bag of shit" is severely misplaced. I have no influence over Linux governance. 99.9999% of us out there don't have that influence. So what was your point exactly? Rants are fine and we all do them but I will strongly disagree with any responsibility or guilt transferred to me because I am excited about Rust and not about OpenSSL. As you yourself pointed out, alternatives exist but aren't adopted so the problem is political and not technical. Right? > The rest of your statement is just making my point for me. Not sure what you mean but okay. ¯\_(ツ)_/¯
      - busterarm 6y ago
        > Furthermore, do consider that some of us were programming C and C++ and found them sub-optimal. But here we would likely venture into language wars because there are a lot of programmers like myself out there who will never subscribe under the notion of "C is fine, you are just doing it wrong". > Not sure what you mean but okay. ¯\_(ツ)_/¯ Blame the carpenter, not the tools. C or C++ isn't a real business problem domain that anyone has. Nobody's committing their budget to fix that. That's the kind of problem only held by ideologues and other unreasonable people. My point was that people who care about fixing problems in the security domain will look to fix the biggest problems they can in the security domain. They won't look at it and say "no, I can't fix this because C/C++ is unacceptable to me." That's someone who cares more about the tools than the problem domain. Whethor or not you think C/C++ are suitable to the problem domain of writing secure software, software will be written in C/C++ and must be secured. Turn down work all you want though. More for the rest of us.

mlindner 6y ago

> Edit: It's almost a meme at this point that you can't even be remotely critical of Rust on this board without kneejerk mass downvoting. I do wonder how it happens as I upvote such people, but I've been posting here for years and still don't have downvote privileges. I do wonder sometimes who controls the downvotes.

busterarm 6y ago
It's gated behind a karma score threshold.