5 ms·

Would you refuse to use Postgres, the Linux kernel or SQLite because they’re all written in C? Certainly C and C++ have more footguns than many other languages

by yashap 5y ago

Would you refuse to use Postgres, the Linux kernel or SQLite because they’re all written in C? Certainly C and C++ have more footguns than many other languages, but highly insecure as well as highly secure software gets written in all languages. I think coming up with better/easier avenues for digital-security-breach related lawsuits and fines is a better idea than banning specific languages.

nine_k 5y ago
Funny that you ask: Linux kernel rather actively embraces experimental code written in Rust. And yes, for a really critical system I might consider taking something much simpler and potentially slower but formally proven correct, like seL4. Google is working on Fuchsia as a new phone / chromebook OS, and it's very much focused on bulletproof security.
- conradev 5y ago
  While Fuschsia's microkernel architecture has a lot of security benefits, the microkernel (Zircon) is still written in C++
  - littlestymaar 5y ago
    Related: > Our kernel, Zircon, [is not in Rust](https://twitter.com/cpuGoogle/status/1397265884251525122 https://twitter.com/cpuGoogle/status/1397265884251525122). Not yet anyway. But it is in [a nice, lean subset of C++](https://fuchsia.dev/fuchsia-src/development/languages/c-cpp/cxx https://fuchsia.dev/fuchsia-src/development/languages/c-cpp/...) which I consider a vast improvement over C. https://blog.cr0.org/2021/06/a-few-thoughts-on-fuchsia-security.html https://blog.cr0.org/2021/06/a-few-thoughts-on-fuchsia-secur...
  - pjmlp 5y ago
    For the time being yes. They are now starting to rewrite OS components in Rust, and I wouldn't be surprised if that happens to Zircon as well, it stared as a C anyway, and thus already suffered one rewrite.
    - nine_k 5y ago
      s/suffered/enjoyed/ A rewrite usually improves a lot of small things that were found in the previous version. It's like a new major version, even if it does not add new major features. It's an expensive undertaking, though.
      - pjmlp 5y ago
        Thanks, if you watch the Fuchsia tour session, they hint at some of the rewriting taking place. https://www.youtube.com/watch?v=gIT1ISCioDY https://www.youtube.com/watch?v=gIT1ISCioDY
- otabdeveloper4 5y ago
  > Linux kernel rather actively embraces experimental code written in Rust False. Which broken telephone did this come from? The Linux kernel has 0% Rust code in it and has no plans to change that.
  - GauntletWizard 5y ago
    https://lore.kernel.org/lkml/20210704202756.29107-1-ojeda@kernel.org/ https://lore.kernel.org/lkml/20210704202756.29107-1-ojeda@ke... - A patch to include experimental rust support, with support from Linus; I believe it's in the latest mainline HEAD.
    - otabdeveloper4 5y ago
      Read my post again. There is 0% Rust code in the Linux kernel at the moment, and no plans to change that. (And no, "including experimental Rust support" isn't a plan to change that.) You don't need Rust to compile the kernel. What's changed now is that you could theoretically write a kernel module in Rust. (But you can, e.g., write a kernel module in C++ too, I've done it before.)
- Ieghaehia9 5y ago
  > And yes, for a really critical system I might consider taking something much simpler and potentially slower but formally proven correct, like seL4. One of seL4's points is that security can still be fast, no? From https://docs.sel4.systems/projects/sel4/frequently-asked-questions.html https://docs.sel4.systems/projects/sel4/frequently-asked-que... >To the best of our knowledge, seL4 is the world’s fastest microkernel on the supported processors, in terms of the usual ping-pong metric: the cost of a cross-address-space message-passing (IPC) operation.
  - nine_k 5y ago
    Yes. But within the Linux kernel, you might not need that cross-process IPC at all, so if you're into squeezing every last microsecond of latency, you likely want your entire app running as a monolith in kernel mode. But if you want security more than top speed, seL4 + a few daemons you write for other OS needs must be fine.
- yashap 5y ago
  As another commenter noted, there’s no Rust code currently in the Linux kernel. There may be some soon, but not much - it’ll be a dominantly C codebase for a very, very long time, maybe forever. As for seL4, doesn’t that just support my point that highly secure software can be written in any language, even C? seL4 is primarily implemented in C. There “executable spec” is written in Haskell, but the actual kernel that people use is written primarily in C and a little Assembly.

by yashap 5y ago

nine_k 5y ago

Funny that you ask: Linux kernel rather actively embraces experimental code written in Rust. And yes, for a really critical system I might consider taking something much simpler and potentially slower but formally proven correct, like seL4. Google is working on Fuchsia as a new phone / chromebook OS, and it's very much focused on bulletproof security.

conradev 5y ago
While Fuschsia's microkernel architecture has a lot of security benefits, the microkernel (Zircon) is still written in C++
- littlestymaar 5y ago
  Related: > Our kernel, Zircon, [is not in Rust](https://twitter.com/cpuGoogle/status/1397265884251525122 https://twitter.com/cpuGoogle/status/1397265884251525122). Not yet anyway. But it is in [a nice, lean subset of C++](https://fuchsia.dev/fuchsia-src/development/languages/c-cpp/cxx https://fuchsia.dev/fuchsia-src/development/languages/c-cpp/...) which I consider a vast improvement over C. https://blog.cr0.org/2021/06/a-few-thoughts-on-fuchsia-security.html https://blog.cr0.org/2021/06/a-few-thoughts-on-fuchsia-secur...
- pjmlp 5y ago
  For the time being yes. They are now starting to rewrite OS components in Rust, and I wouldn't be surprised if that happens to Zircon as well, it stared as a C anyway, and thus already suffered one rewrite.
  - nine_k 5y ago
    s/suffered/enjoyed/ A rewrite usually improves a lot of small things that were found in the previous version. It's like a new major version, even if it does not add new major features. It's an expensive undertaking, though.
    - pjmlp 5y ago
      Thanks, if you watch the Fuchsia tour session, they hint at some of the rewriting taking place. https://www.youtube.com/watch?v=gIT1ISCioDY https://www.youtube.com/watch?v=gIT1ISCioDY
otabdeveloper4 5y ago
> Linux kernel rather actively embraces experimental code written in Rust False. Which broken telephone did this come from? The Linux kernel has 0% Rust code in it and has no plans to change that.
- GauntletWizard 5y ago
  https://lore.kernel.org/lkml/20210704202756.29107-1-ojeda@kernel.org/ https://lore.kernel.org/lkml/20210704202756.29107-1-ojeda@ke... - A patch to include experimental rust support, with support from Linus; I believe it's in the latest mainline HEAD.
  - otabdeveloper4 5y ago
    Read my post again. There is 0% Rust code in the Linux kernel at the moment, and no plans to change that. (And no, "including experimental Rust support" isn't a plan to change that.) You don't need Rust to compile the kernel. What's changed now is that you could theoretically write a kernel module in Rust. (But you can, e.g., write a kernel module in C++ too, I've done it before.)
Ieghaehia9 5y ago
> And yes, for a really critical system I might consider taking something much simpler and potentially slower but formally proven correct, like seL4. One of seL4's points is that security can still be fast, no? From https://docs.sel4.systems/projects/sel4/frequently-asked-questions.html https://docs.sel4.systems/projects/sel4/frequently-asked-que... >To the best of our knowledge, seL4 is the world’s fastest microkernel on the supported processors, in terms of the usual ping-pong metric: the cost of a cross-address-space message-passing (IPC) operation.
- nine_k 5y ago
  Yes. But within the Linux kernel, you might not need that cross-process IPC at all, so if you're into squeezing every last microsecond of latency, you likely want your entire app running as a monolith in kernel mode. But if you want security more than top speed, seL4 + a few daemons you write for other OS needs must be fine.
yashap 5y ago
As another commenter noted, there’s no Rust code currently in the Linux kernel. There may be some soon, but not much - it’ll be a dominantly C codebase for a very, very long time, maybe forever. As for seL4, doesn’t that just support my point that highly secure software can be written in any language, even C? seL4 is primarily implemented in C. There “executable spec” is written in Haskell, but the actual kernel that people use is written primarily in C and a little Assembly.