4 ms·

Where is your legislation supposed to draw the line? In Rust you need to have occasional unsafe code - you can't even have a double linked list or bidirectional

Where is your legislation supposed to draw the line? In Rust you need to have occasional unsafe code - you can't even have a double linked list or bidirectional graph without unsafe code. Would you also outlaw jni calls in java?

staticassertion 5y ago
The way this would likely end up being handled is the same as any other compliance. You define the threat model for your application and then justify why you're safe. In this case we'd be adding an explicit point to ensure that there are controls for attackers who can exploit memory safety issues. You could end up with controls like: 1. We sandbox our code, so even though it's C we feel that we're safe 2. We use a memory safe language to reduce the risk of memory safety issues 3. We sanitizer inputs before providing them to the program etc etc What ends up being accepted as legitimate would be up to the auditors/ generally a matter of consensus.
- MichaelMoser123 5y ago
  would that imply that the state would have to review the design and implementation of every system under their jurisdiction? I think that would be a bit heavy for everyone involved.
  - staticassertion 5y ago
    This is already the case.
FractalHQ 5y ago
Can’t unsafe Rust (when properly isolated) exist within a larger codebase that, as a whole, can still be considered safe?
- lionkor 5y ago
  The same way you can write safe modern C++ and only use unsafe features of the language when its necessary and isolated, but thats also considered unsafe, so Rust should be, too
  - pjmlp 5y ago
    My experience with trying that in Visual C++, alongside the C++ Core Guidelines and "borrow checker" static analysers, is that there is what we wish to happen, and how the code actually looks like in reality.
    - lionkor 5y ago
      I find that, if you enable all warnings, most as errors, and use clang-tidy and cppcheck, you end up with an incredibly powerful safe language. Now, combine that with some good patterns and avoidance of NIH syndrome, and you can get very far while keeping the huge amount of control and libraries that C++ gives. Edit: And, of course, a lot of forced static typing and avoiding global scoped stuff. So, for example, you'd make a struct Meter { float value { 0.0f }; }; Meter wall_length; instead of `float wall_length; // meters`.
      - pjmlp 5y ago
        Even if we constrain ourselves to clang-tidy and cppcheck, and the platforms where they are supported, you can only assert that to your own code, and eventually third party libraries in source code. Then even if you find issues in those third party code libraries, there is the issue of if you are allowed to change them yourself, or how those fixes get provided by the library vendor, warranties and so on.

staticassertion 5y ago

The way this would likely end up being handled is the same as any other compliance. You define the threat model for your application and then justify why you're safe. In this case we'd be adding an explicit point to ensure that there are controls for attackers who can exploit memory safety issues. You could end up with controls like: 1. We sandbox our code, so even though it's C we feel that we're safe 2. We use a memory safe language to reduce the risk of memory safety issues 3. We sanitizer inputs before providing them to the program etc etc What ends up being accepted as legitimate would be up to the auditors/ generally a matter of consensus.

MichaelMoser123 5y ago
would that imply that the state would have to review the design and implementation of every system under their jurisdiction? I think that would be a bit heavy for everyone involved.
- staticassertion 5y ago
  This is already the case.

FractalHQ 5y ago

Can’t unsafe Rust (when properly isolated) exist within a larger codebase that, as a whole, can still be considered safe?

lionkor 5y ago
The same way you can write safe modern C++ and only use unsafe features of the language when its necessary and isolated, but thats also considered unsafe, so Rust should be, too
- pjmlp 5y ago
  My experience with trying that in Visual C++, alongside the C++ Core Guidelines and "borrow checker" static analysers, is that there is what we wish to happen, and how the code actually looks like in reality.
  - lionkor 5y ago
    I find that, if you enable all warnings, most as errors, and use clang-tidy and cppcheck, you end up with an incredibly powerful safe language. Now, combine that with some good patterns and avoidance of NIH syndrome, and you can get very far while keeping the huge amount of control and libraries that C++ gives. Edit: And, of course, a lot of forced static typing and avoiding global scoped stuff. So, for example, you'd make a struct Meter { float value { 0.0f }; }; Meter wall_length; instead of `float wall_length; // meters`.
    - pjmlp 5y ago
      Even if we constrain ourselves to clang-tidy and cppcheck, and the platforms where they are supported, you can only assert that to your own code, and eventually third party libraries in source code. Then even if you find issues in those third party code libraries, there is the issue of if you are allowed to change them yourself, or how those fixes get provided by the library vendor, warranties and so on.