4 ms·

Half those applications are going to have other classes of new bugs simply because it’s new code and they’ve had less people audit the code. Plus some of those

Half those applications are going to have other classes of new bugs simply because it’s new code and they’ve had less people audit the code. Plus some of those original tools were already written in safe languages like Haskell.

lmm 5y ago
> Half those applications are going to have other classes of new bugs simply because it’s new code and they’ve had less people audit the code. True. But most other classes of bug are not security bugs by default in the way that memory safety bugs are.
- laumars 5y ago
  That’s not true at all. 2 of the 3 biggest security vulnerabilities I’ve had to deal with in my career were completely unrelated and wouldn’t have been prevented had software been written in Rust instead. Also half the software mentioned in that gist should never be used in security-focused applications anyway (if your depending on ‘cat’ or ‘awk’ to be bug free for your application to be hardened then you’re already doing it wrong)
  - bluGill 5y ago
    I use cat and awk in my build system. I can imagine bugs in either that I wouldn't notice in general that would compromise my application. They are off the wall enough that I don't think they have ever happened, but my application is an embedded system that has the ability to kill people so I'm a little paranoid. (not so much that I don't use awk in my build system where it is a useful tool)
    - laumars 5y ago
      My point was if you’re exposing your build system to untrusted individuals inputting untrusted data then you’ve already lost the game. Rust won’t save you from a RCE bug because you’ve already granted them RCE from the beginning. An overflow bug in awk is only exploitable if someone can craft input into awk. And if you’re allowing people to do that then you’ve already given them access to remotely run code without them needing a bug.
      - staticassertion 5y ago
        > My point was if you’re exposing your build system to untrusted individuals inputting untrusted data then you’ve already lost the game. This is how the vast majority of build systems are configured. If I have owned a dev and can push code to a branch I can likely execute code in their build environment. If they then parse that build output with something like awk, that's attack surface. Is it the first thing I'd try to attack? Nope. But I do wonder what the cumulative impact of every binary on your system being memory safe would be. I'd definitely feel better.
        laumars 5y ago
        > If I have owned a dev and can push code to a branch I can likely execute code in their build environment. But then you’re also executing that code as a trusted user. Ie the real hack is owning the dev. > This is how the vast majority of build systems are configured. No. The vast majority of build systems are either locked to private repositories, and/or a subset of developers, and/or run in an ephemeral sandbox. > But I do wonder what the cumulative impact of every binary on your system being memory safe would be. I’d already answered that. It’s negligible because if someone can exploit a buffer overflow in awk then they can already run arbitrary code in awk (remember, awk is a programming language). So if you’re not already taking precautions about who is running what on your build system and how running code is sandboxes then it’s not going to take a buffer overflow bug to RCE it.
        staticassertion 5y ago
        > But then you’re also executing that code as a trusted user. Ie the real hack is owning the dev. That's like saying the real hack is sending a phishing email, ignoring all privesc, lateral movement, etc. > No. The vast majority of build systems are either locked to private repositories, and/or a subset of developers, and/or run in an ephemeral sandbox. I didn't say otherwise. I said that the majority allow untrusted execution. If you consider your engineers laptops to be trusted you're thinking about networks the way people did ~10+ years ago. > It’s negligible because if someone can exploit a buffer overflow in awk then they can already run arbitrary code in awk This isn't true, but even if it were you can just replace awk with anything else that's not turing complete.
  - lmm 5y ago
    > 2 of the 3 biggest security vulnerabilities I’ve had to deal with in my career were completely unrelated and wouldn’t have been prevented had software been written in Rust instead. The last study I saw was that 52% of security vulnerabilities were still basic memory safety vulnerabilities. Memory safety isn't the only thing, but it's still the biggest thing. > (if your depending on ‘cat’ or ‘awk’ to be bug free for your application to be hardened then you’re already doing it wrong) People run cat or awk on log files (where an attacker could easily craft particular data patterns) all the time. Maybe they shouldn't, but they do.
    - laumars 5y ago
      > The last study I saw was that 52% of security vulnerabilities were still basic memory safety vulnerabilities. Memory safety isn't the only thing, but it's still the biggest thing. My point wasn’t that memory safety isn’t a big issue. It’s that it’s not the only cause of vulnerabilities. Assuming your 52% figure is accurate (and I’m happy to take your word on that) that still means that roughly half of all vulnerabilities are not memory safety. Which means your figure actually just reinforces my point. > People run cat or awk on log files (where an attacker could easily craft particular data patterns) all the time. Maybe they shouldn't, but they do. I think there’s enough obscurity there hidden from the attacker that such usage should be safe from all but the most determined of attacker. And even then, they’d likely need some other attack to probe for usage about what systems are listening to what logs and using which POSIX utils that you could argue the attacker already has the access they need without going to the pain of crafting an overflow bug in a log file. Im not saying those bugs don’t exist nor shouldn’t be addressed, I’m just being pragmatic about their exploitability. The bigger issue is CI/CD pipelines. Often they’re define in the same mono-repo as the source itself and they’ll have execution rights automatically because that’s literally their function as a build and test pipeline. But because said pipelines are already visible and already executable, you need to have greater controls around that pipeline to prevent abuse otherwise it’s already game over even without an overflow bug.
      - lmm 5y ago
        > Assuming your 52% figure is accurate (and I’m happy to take your word on that) that still means that roughly half of all vulnerabilities are not memory safety. Sure, but that half is every other category of bug put together. I guess if your model is that every other class of bug will be significantly increased by a rewrite then maybe that logic makes sense, but that seems unlikely to me.
pdimitar 5y ago
I too am not convinced that Haskell tools have to be replaced by Rust ones. In my eyes Rust's main applicability in this situation would be to replace C/C++ tools. As for other kinds of bugs, yeah, that's inevitable, but I still prefer to have the memory safety bugs eliminated from the get go so I'd still say it's a worthy sacrifice to walk the road to safe tools one more time just for the memory safety. So yeah, no need to rewrite tools in already memory safe languages but when it comes to C/C++ tools then yes, we need to rewrite them.
yitchelle 5y ago
I cannot upvote this comment enough. This list of tools are tried and trusted, and have under went 1000s of hours of usage. Sure that given enough resources, motivation and time, Anything is possible. But new code means bugs and uncertainty. Some of the tools listed are not small if a one for one replacement is the target. Vim is listed?? How long before these tools are considered as matured and ready for production?
pizza234 5y ago
To note that the parent post was not referring to rewrites, but to the language a package was written in first place, which is an important distinction.

lmm 5y ago

> Half those applications are going to have other classes of new bugs simply because it’s new code and they’ve had less people audit the code. True. But most other classes of bug are not security bugs by default in the way that memory safety bugs are.

laumars 5y ago
That’s not true at all. 2 of the 3 biggest security vulnerabilities I’ve had to deal with in my career were completely unrelated and wouldn’t have been prevented had software been written in Rust instead. Also half the software mentioned in that gist should never be used in security-focused applications anyway (if your depending on ‘cat’ or ‘awk’ to be bug free for your application to be hardened then you’re already doing it wrong)
- bluGill 5y ago
  I use cat and awk in my build system. I can imagine bugs in either that I wouldn't notice in general that would compromise my application. They are off the wall enough that I don't think they have ever happened, but my application is an embedded system that has the ability to kill people so I'm a little paranoid. (not so much that I don't use awk in my build system where it is a useful tool)
  - laumars 5y ago
    My point was if you’re exposing your build system to untrusted individuals inputting untrusted data then you’ve already lost the game. Rust won’t save you from a RCE bug because you’ve already granted them RCE from the beginning. An overflow bug in awk is only exploitable if someone can craft input into awk. And if you’re allowing people to do that then you’ve already given them access to remotely run code without them needing a bug.
    - staticassertion 5y ago
      > My point was if you’re exposing your build system to untrusted individuals inputting untrusted data then you’ve already lost the game. This is how the vast majority of build systems are configured. If I have owned a dev and can push code to a branch I can likely execute code in their build environment. If they then parse that build output with something like awk, that's attack surface. Is it the first thing I'd try to attack? Nope. But I do wonder what the cumulative impact of every binary on your system being memory safe would be. I'd definitely feel better.
      - laumars 5y ago
        > If I have owned a dev and can push code to a branch I can likely execute code in their build environment. But then you’re also executing that code as a trusted user. Ie the real hack is owning the dev. > This is how the vast majority of build systems are configured. No. The vast majority of build systems are either locked to private repositories, and/or a subset of developers, and/or run in an ephemeral sandbox. > But I do wonder what the cumulative impact of every binary on your system being memory safe would be. I’d already answered that. It’s negligible because if someone can exploit a buffer overflow in awk then they can already run arbitrary code in awk (remember, awk is a programming language). So if you’re not already taking precautions about who is running what on your build system and how running code is sandboxes then it’s not going to take a buffer overflow bug to RCE it.
        staticassertion 5y ago
        > But then you’re also executing that code as a trusted user. Ie the real hack is owning the dev. That's like saying the real hack is sending a phishing email, ignoring all privesc, lateral movement, etc. > No. The vast majority of build systems are either locked to private repositories, and/or a subset of developers, and/or run in an ephemeral sandbox. I didn't say otherwise. I said that the majority allow untrusted execution. If you consider your engineers laptops to be trusted you're thinking about networks the way people did ~10+ years ago. > It’s negligible because if someone can exploit a buffer overflow in awk then they can already run arbitrary code in awk This isn't true, but even if it were you can just replace awk with anything else that's not turing complete.
- lmm 5y ago
  > 2 of the 3 biggest security vulnerabilities I’ve had to deal with in my career were completely unrelated and wouldn’t have been prevented had software been written in Rust instead. The last study I saw was that 52% of security vulnerabilities were still basic memory safety vulnerabilities. Memory safety isn't the only thing, but it's still the biggest thing. > (if your depending on ‘cat’ or ‘awk’ to be bug free for your application to be hardened then you’re already doing it wrong) People run cat or awk on log files (where an attacker could easily craft particular data patterns) all the time. Maybe they shouldn't, but they do.
  - laumars 5y ago
    > The last study I saw was that 52% of security vulnerabilities were still basic memory safety vulnerabilities. Memory safety isn't the only thing, but it's still the biggest thing. My point wasn’t that memory safety isn’t a big issue. It’s that it’s not the only cause of vulnerabilities. Assuming your 52% figure is accurate (and I’m happy to take your word on that) that still means that roughly half of all vulnerabilities are not memory safety. Which means your figure actually just reinforces my point. > People run cat or awk on log files (where an attacker could easily craft particular data patterns) all the time. Maybe they shouldn't, but they do. I think there’s enough obscurity there hidden from the attacker that such usage should be safe from all but the most determined of attacker. And even then, they’d likely need some other attack to probe for usage about what systems are listening to what logs and using which POSIX utils that you could argue the attacker already has the access they need without going to the pain of crafting an overflow bug in a log file. Im not saying those bugs don’t exist nor shouldn’t be addressed, I’m just being pragmatic about their exploitability. The bigger issue is CI/CD pipelines. Often they’re define in the same mono-repo as the source itself and they’ll have execution rights automatically because that’s literally their function as a build and test pipeline. But because said pipelines are already visible and already executable, you need to have greater controls around that pipeline to prevent abuse otherwise it’s already game over even without an overflow bug.
    - lmm 5y ago
      > Assuming your 52% figure is accurate (and I’m happy to take your word on that) that still means that roughly half of all vulnerabilities are not memory safety. Sure, but that half is every other category of bug put together. I guess if your model is that every other class of bug will be significantly increased by a rewrite then maybe that logic makes sense, but that seems unlikely to me.

pdimitar 5y ago

I too am not convinced that Haskell tools have to be replaced by Rust ones. In my eyes Rust's main applicability in this situation would be to replace C/C++ tools. As for other kinds of bugs, yeah, that's inevitable, but I still prefer to have the memory safety bugs eliminated from the get go so I'd still say it's a worthy sacrifice to walk the road to safe tools one more time just for the memory safety. So yeah, no need to rewrite tools in already memory safe languages but when it comes to C/C++ tools then yes, we need to rewrite them.

yitchelle 5y ago

I cannot upvote this comment enough. This list of tools are tried and trusted, and have under went 1000s of hours of usage. Sure that given enough resources, motivation and time, Anything is possible. But new code means bugs and uncertainty. Some of the tools listed are not small if a one for one replacement is the target. Vim is listed?? How long before these tools are considered as matured and ready for production?

pizza234 5y ago

To note that the parent post was not referring to rewrites, but to the language a package was written in first place, which is an important distinction.