3 ms·

Oh, I totally disagree with you. I'm well aware of how Chromium's C++ code works, and I'm aware of oilpan, I don't think it's fair at all to say it solves memor

Oh, I totally disagree with you. I'm well aware of how Chromium's C++ code works, and I'm aware of oilpan, I don't think it's fair at all to say it solves memory safety issues. Proof's in the pudding. ITW exploits are there.

pjmlp 5y ago
While Rust has safer defaults, exploits are still possible depending on how well unsafe {} blocks are manually checked for correctness.
- staticassertion 5y ago
  Yes, which means you can grep for vulnerabilities.
  - pjmlp 5y ago
    Logic errors in unsafe blocks usually aren't grepable. Speaking from experience using managed languages, and almost safe systems languages, with unsafe blocks support.
    - staticassertion 5y ago
      Yes they are, you just grep for "unsafe". Speaking from a career in information security, vuln research, and as a rust engineer.
      - pjmlp 5y ago
        It requires a human to actually look at the contents of the unsafe block. Most of the time those humans are even rarer than those that validate unit tests are properly written. Also you cannot grep for unsafe in binary libraries.
        est31 5y ago
        If your >95% of your codebase doesn't feature unsafe, your rare human with the review skills only has to look at the remaining 5%, maybe 10% in order to understand what the 5% are doing.
        pjmlp 5y ago
        Yeah, we all know how every project has unit tests, follows TDD best practices, is part of a CI/CD pipeline and has exemplary documentation. Unsafe blocks are better than not having them, provided there is such human.
        staticassertion 5y ago
        > It requires a human to actually look at the contents of the unsafe block. Yes, that's an incredible capability - that a human can actually look to find bugs, that's insane, that's huge. > Most of the time those humans are even rarer than those that validate unit tests are properly written. Maybe, maybe. Is it rarer than fuzzing with sanitizers though? Or rarer than serious sandboxing efforts? When unsafe has been used gratuitously in Rust libraries the community has pushed back, to a fault. I don't know what it is you want to try to argue here though. My questions were really targeted to someone at Google who can speak more directly to what I've been seeing for years.
        pjmlp 5y ago
        I am trying to argue that just by using a safer systems programming language, the security exploits don't go away. Someone needs to take care that the remaining 30% are taken care of. While the unsafe blocks are still responsible for the remaining 70% if no one bothers to actually validate them. Actix Web is a very good example, how the community still has to learn how to deal with such issues, and how effective the security would have been, if its security wasn't validated by fellow humans. Yes it is definitly better than C, C++ or Objective-C, just not zero effort to keep it safe.
        staticassertion 5y ago

pjmlp 5y ago

While Rust has safer defaults, exploits are still possible depending on how well unsafe {} blocks are manually checked for correctness.

staticassertion 5y ago
Yes, which means you can grep for vulnerabilities.
- pjmlp 5y ago
  Logic errors in unsafe blocks usually aren't grepable. Speaking from experience using managed languages, and almost safe systems languages, with unsafe blocks support.
  - staticassertion 5y ago
    Yes they are, you just grep for "unsafe". Speaking from a career in information security, vuln research, and as a rust engineer.
    - pjmlp 5y ago
      It requires a human to actually look at the contents of the unsafe block. Most of the time those humans are even rarer than those that validate unit tests are properly written. Also you cannot grep for unsafe in binary libraries.
      - est31 5y ago
        If your >95% of your codebase doesn't feature unsafe, your rare human with the review skills only has to look at the remaining 5%, maybe 10% in order to understand what the 5% are doing.
        pjmlp 5y ago
        Yeah, we all know how every project has unit tests, follows TDD best practices, is part of a CI/CD pipeline and has exemplary documentation. Unsafe blocks are better than not having them, provided there is such human.
      - staticassertion 5y ago
        > It requires a human to actually look at the contents of the unsafe block. Yes, that's an incredible capability - that a human can actually look to find bugs, that's insane, that's huge. > Most of the time those humans are even rarer than those that validate unit tests are properly written. Maybe, maybe. Is it rarer than fuzzing with sanitizers though? Or rarer than serious sandboxing efforts? When unsafe has been used gratuitously in Rust libraries the community has pushed back, to a fault. I don't know what it is you want to try to argue here though. My questions were really targeted to someone at Google who can speak more directly to what I've been seeing for years.
        pjmlp 5y ago
        I am trying to argue that just by using a safer systems programming language, the security exploits don't go away. Someone needs to take care that the remaining 30% are taken care of. While the unsafe blocks are still responsible for the remaining 70% if no one bothers to actually validate them. Actix Web is a very good example, how the community still has to learn how to deal with such issues, and how effective the security would have been, if its security wasn't validated by fellow humans. Yes it is definitly better than C, C++ or Objective-C, just not zero effort to keep it safe.
        staticassertion 5y ago