4 ms·

Eh, memory safety hasn't ever really been the problem with mod_tls, or curl, but it would be nice to have some solid examples for other projects to build on. T

by px43 5y ago

Eh, memory safety hasn't ever really been the problem with mod_tls, or curl, but it would be nice to have some solid examples for other projects to build on. The Linux kernel project sounds interesting. It would be nice if there was an effort to purge as much C code as possible from the core of the kernel and really enforce standards such that even a maliciously designed kernel module should not be vulnerable to memory corruption bugs.

deleted 5y ago
[deleted]
topspin 5y ago
Here[1] is the ongoing list of "curl security problems." Note the several memory safety related issues. The two most recent are: May 26, 2021 CWE-416: Use After Free May 26, 2021 CWE-457: Use of Uninitialized Variable There are numerous others that follow including out-of-bounds reads, overflows, etc. I can't imagine where you got the idea that this somehow "hasn't ever really been" a problem for curl. [1] https://curl.se/docs/security.html https://curl.se/docs/security.html
simion314 5y ago
Why not have all this Rust energy focused on a new kernel (not a toy/experiment), a kernel architect ed not evolved. You would get better results and if you need Linux compatibility add support for it from the start in soem kind of emulation/compatibility layer. Putting Rust into kernel seems to me that is a lot of effor for microscopic gains.
- aaomidi 5y ago
  A new kernel has a massive uphill battle to fight to get to where Linux is today. Like, an absolutely huge battle to fight. Although it would be great to eventually see it.
  - simion314 5y ago
    I know, but Linux will not be forever, someone will start a new kernel that will replace it. All this giant tech companies could afford to pay some experienced people to start working on it. The initial scope would be limited but if the architecture and the language combo would give it a performance and security boost then for sure it will be adopted and new contributors would appear. If the performance/security would be similar to Linux/BSD then for sure the progress would be very slow.
    - tialaramex 5y ago
      > Linux will not be forever Linux is thirty years old. And Linux isn't something from whole cloth, it's a Unix, it didn't have some legal and technical baggage that UNIX® brand Unix had but it's a Unix. And Unix is over sixty years old. We may very well be done. Unix isn't the best conceivable Operating System, but it seems like it's good enough, and in being good enough it became so enormously popular that any new alternative has to be night-and-day better or why bother? I'm reminded of the Two's Complement Integer thing. Historically it was unclear if this was the "best" way for integers to work. Hardware existed, and sold well decades ago, with some other ideas for how integers could be represented and calculated. But, gradually, over time, even if Two's Complement wasn't clearly the best, it was clearly the most popular, and the others weren't clearly better so why fight it? Sure enough, "Two's Complement Integers" get to just be how integers work by default in newer languages. If Linus and all the subsystems people were screaming "Nothing but C, under any circumstances" then perhaps you could imagine a competitor to Linux comes along in ten, twenty, thirty years. But so long as they remain open to changes that actually have good results, they're going to stay on top.
    - Ericson2314 5y ago
      Rust has been prominent in Fuscia's userland (which is bigger proportionally because it's a microkernel), but not the kernel (Zircon) itself. Considering Google's funding of these ISRG projects, I hope this changes.
- huachimingo 5y ago
  Redox OS https://www.redox-os.org/ https://www.redox-os.org/
- Ericson2314 5y ago
  I think they are complementary goals. On aspect of the Rust-on-Linux worked I've helped out with is trying to make sure standard library abstractions aren't just suitable for userspace. I hope the medium term result of this is more comparability between bare metal projects on axes where they aren't trying to differentiate. Longer term, I hope that means a corpus of driver that can be shared between kernels, revolutionizing kernel diversity the same way LLVM revolutionized programming language diversity.
- tptacek 5y ago
  Because ISRG is trying to direct funds to projects that will actually protect current Internet users; notably, this isn't a research project, but rather a funded engineering project, focusing on things that are already in wide use.
- geofft 5y ago
  Li et al., "An Incremental Path Towards a Safer OS Kernel," HotOS 2021 (two weeks ago), is an academic paper arguing that putting Rust into an existing kernel will deliver you much more than microscopic gains and will yield better results than starting from scratch. https://sigops.org/s/conferences/hotos/2021/papers/hotos21-s09-li.pdf https://sigops.org/s/conferences/hotos/2021/papers/hotos21-s...
tialaramex 5y ago
Memory safety hasn't been a problem with mod_tls because mod_tls is the module written in Rust. But likely you were thinking of mod_ssl. Except, mod_ssl is how Apache ends up using OpenSSL, where the famous Heartbleed bug is literally exactly the sort of memory unsafety that you'd never do in Rust.
dbaupp 5y ago
The author of curl wrote https://daniel.haxx.se/blog/2021/03/09/half-of-curls-vulnerabilities-are-c-mistakes/ https://daniel.haxx.se/blog/2021/03/09/half-of-curls-vulnera... which fundamentally disagrees with your assertion about it.

by px43 5y ago

deleted 5y ago

[deleted]

topspin 5y ago

Here[1] is the ongoing list of "curl security problems." Note the several memory safety related issues. The two most recent are: May 26, 2021 CWE-416: Use After Free May 26, 2021 CWE-457: Use of Uninitialized Variable There are numerous others that follow including out-of-bounds reads, overflows, etc. I can't imagine where you got the idea that this somehow "hasn't ever really been" a problem for curl. [1] https://curl.se/docs/security.html https://curl.se/docs/security.html

simion314 5y ago

Why not have all this Rust energy focused on a new kernel (not a toy/experiment), a kernel architect ed not evolved. You would get better results and if you need Linux compatibility add support for it from the start in soem kind of emulation/compatibility layer. Putting Rust into kernel seems to me that is a lot of effor for microscopic gains.

aaomidi 5y ago
A new kernel has a massive uphill battle to fight to get to where Linux is today. Like, an absolutely huge battle to fight. Although it would be great to eventually see it.
- simion314 5y ago
  I know, but Linux will not be forever, someone will start a new kernel that will replace it. All this giant tech companies could afford to pay some experienced people to start working on it. The initial scope would be limited but if the architecture and the language combo would give it a performance and security boost then for sure it will be adopted and new contributors would appear. If the performance/security would be similar to Linux/BSD then for sure the progress would be very slow.
  - tialaramex 5y ago
    > Linux will not be forever Linux is thirty years old. And Linux isn't something from whole cloth, it's a Unix, it didn't have some legal and technical baggage that UNIX® brand Unix had but it's a Unix. And Unix is over sixty years old. We may very well be done. Unix isn't the best conceivable Operating System, but it seems like it's good enough, and in being good enough it became so enormously popular that any new alternative has to be night-and-day better or why bother? I'm reminded of the Two's Complement Integer thing. Historically it was unclear if this was the "best" way for integers to work. Hardware existed, and sold well decades ago, with some other ideas for how integers could be represented and calculated. But, gradually, over time, even if Two's Complement wasn't clearly the best, it was clearly the most popular, and the others weren't clearly better so why fight it? Sure enough, "Two's Complement Integers" get to just be how integers work by default in newer languages. If Linus and all the subsystems people were screaming "Nothing but C, under any circumstances" then perhaps you could imagine a competitor to Linux comes along in ten, twenty, thirty years. But so long as they remain open to changes that actually have good results, they're going to stay on top.
  - Ericson2314 5y ago
    Rust has been prominent in Fuscia's userland (which is bigger proportionally because it's a microkernel), but not the kernel (Zircon) itself. Considering Google's funding of these ISRG projects, I hope this changes.
huachimingo 5y ago
Redox OS https://www.redox-os.org/ https://www.redox-os.org/
Ericson2314 5y ago
I think they are complementary goals. On aspect of the Rust-on-Linux worked I've helped out with is trying to make sure standard library abstractions aren't just suitable for userspace. I hope the medium term result of this is more comparability between bare metal projects on axes where they aren't trying to differentiate. Longer term, I hope that means a corpus of driver that can be shared between kernels, revolutionizing kernel diversity the same way LLVM revolutionized programming language diversity.
tptacek 5y ago
Because ISRG is trying to direct funds to projects that will actually protect current Internet users; notably, this isn't a research project, but rather a funded engineering project, focusing on things that are already in wide use.
geofft 5y ago
Li et al., "An Incremental Path Towards a Safer OS Kernel," HotOS 2021 (two weeks ago), is an academic paper arguing that putting Rust into an existing kernel will deliver you much more than microscopic gains and will yield better results than starting from scratch. https://sigops.org/s/conferences/hotos/2021/papers/hotos21-s09-li.pdf https://sigops.org/s/conferences/hotos/2021/papers/hotos21-s...

tialaramex 5y ago

Memory safety hasn't been a problem with mod_tls because mod_tls is the module written in Rust. But likely you were thinking of mod_ssl. Except, mod_ssl is how Apache ends up using OpenSSL, where the famous Heartbleed bug is literally exactly the sort of memory unsafety that you'd never do in Rust.

dbaupp 5y ago

The author of curl wrote https://daniel.haxx.se/blog/2021/03/09/half-of-curls-vulnerabilities-are-c-mistakes/ https://daniel.haxx.se/blog/2021/03/09/half-of-curls-vulnera... which fundamentally disagrees with your assertion about it.