4 ms·
Is it a replacement for freeipa? Key cloak?
by _Anima_ 5y ago
Is it a replacement for freeipa? Key cloak?
- mooreds 5y agoLooks like it squarely competes with FreeIPA. Maybe main differentiator is that FreIPA is in python whereas this is in rust (and so less prone to bugs)?
- rzzzt 5y agoIs it a widely held concept that Rust is less prone to bugs compared to Python? I've only heard it being compared to C, and only wrt. memory safety bugs.
- tptacek 5y agoRust is statically typed and doesn't have null returns, so it's got advantages for correctness, but the big win with Rust vs. Python would be performance, not security.
- yaleman 5y agoThere's a lot more checks and balances built into rust as a language, so the foot-gun opportunities are less likely - which makes it rather suitable for reliable systems programming. And getting back to this particular case... kanidm is fast AND reliable. There's a lot of testing going on comparing it to 389 DS.
- tptacek 5y agoYes, I write a fair bit of Rust. I'm just saying: between Python and Rust, there isn't that much of a security difference (you could nitpick things like deserialization in Python, but really the significant security win of Rust is not having memory corruption flaws, which Python has never really had.)
- yaleman 5y agoYes, it's a replacement for both - still in (a rapidly developing) Alpha stage currently. So far LDAP and PAM/NSS modules are fully operational, and OAuth's being tested.