4 ms·

I think the point of this project is less about getting rid of GNU, and more about promoting Rust. There's nothing wrong with GNU coreutils.

by bogwog 5y ago

adgjlsfhk1 5y ago
https://www.cvedetails.com/vulnerability-list.php?vendor_id=72&product_id=5075 https://www.cvedetails.com/vulnerability-list.php?vendor_id=.... 4 vulns in the past decade that rust wouldn't have had.
- staticassertion 5y ago
  It would be nice to have a totally memory safe userland, but it's at least worth noting that most of cureutils is generally not going to be working with attacker controlled data in a way that really matters. Again, would be nice, just not where I'd start. But kudos to anyone doing the work.
- ljm 5y ago
  4 vulnerabilities in 10 years sounds like a fantastic record, considering that the coreutils as a singular package has been around for 20 years (and the original tools for far, far longer). That's twice as long as Rust has been around. Not to mention that memory safety is just one aspect of security. Rust's ownership model might have prevented those 4 vulnerabilities, but that doesn't mean that a whole host of others couldn't have slipped through.
  - adgjlsfhk1 5y ago
    If 4 vulns in 10 years for 1 package is acceptable, you are accepting that your OS will constantly have bugs. Sure there are other security problems than memory safety, but of the exploitable bugs, buffer overflows of some sort account for a majority.
    - ljm 5y ago
      My OS does constantly have bugs. It would be pretty unreasonable to say that my OS should never have bugs because of the practical impossibility of delivering perfectly bug-free software. So if people, after 10 years of trying, only found 4 critical vulnerabilities in all of coreutils, then that seems pretty good to me. Rust itself has had 9 CVEs relating to memory safety in 2021 alone[0], which you can justify because Rust's development is highly active. https://www.cvedetails.com/vulnerability-list/vendor_id-19029/product_id-48677/year-2021/opov-1/Rust-lang-Rust.html https://www.cvedetails.com/vulnerability-list/vendor_id-1902...
      - steveklabnik 5y ago
        Recently there's been some folks "backfilling" CVEs. For example, the last one on that list was filed in 2021, but was fixed in 2015. The second to last one was filed in 2021, but was fixed in 2020.
        ljm 5y ago
        What would motivate someone to do that? Sounds misleading to file a bunch of CVEs years after the fact.
        steveklabnik 5y ago
        The idea is, a lot of tooling relies on the CVE system to determine if a system is vulnerable, and so making sure that there is an actual CVE filed for every security bug is a good idea for the robustness of said tooling. At least, that's my understanding.
GhettoComputers 5y ago
From a performance standpoint I love love trying them and eagerly seeing if I can replace the GNU tools. Its like using musl over glibc.
- bogwog 5y ago
  What kind of performance issues are you running into with GNU tools?
  - GhettoComputers 5y ago
    I installed rust implementations and they’re all just much faster

I think the point of this project is less about getting rid of GNU, and more about promoting Rust. There's nothing wrong with GNU coreutils.

by bogwog 5y ago

I think the point of this project is less about getting rid of GNU, and more about promoting Rust. There's nothing wrong with GNU coreutils.

adgjlsfhk1 5y ago

https://www.cvedetails.com/vulnerability-list.php?vendor_id=72&product_id=5075 https://www.cvedetails.com/vulnerability-list.php?vendor_id=.... 4 vulns in the past decade that rust wouldn't have had.

staticassertion 5y ago
It would be nice to have a totally memory safe userland, but it's at least worth noting that most of cureutils is generally not going to be working with attacker controlled data in a way that really matters. Again, would be nice, just not where I'd start. But kudos to anyone doing the work.
ljm 5y ago
4 vulnerabilities in 10 years sounds like a fantastic record, considering that the coreutils as a singular package has been around for 20 years (and the original tools for far, far longer). That's twice as long as Rust has been around. Not to mention that memory safety is just one aspect of security. Rust's ownership model might have prevented those 4 vulnerabilities, but that doesn't mean that a whole host of others couldn't have slipped through.
- adgjlsfhk1 5y ago
  If 4 vulns in 10 years for 1 package is acceptable, you are accepting that your OS will constantly have bugs. Sure there are other security problems than memory safety, but of the exploitable bugs, buffer overflows of some sort account for a majority.
  - ljm 5y ago
    My OS does constantly have bugs. It would be pretty unreasonable to say that my OS should never have bugs because of the practical impossibility of delivering perfectly bug-free software. So if people, after 10 years of trying, only found 4 critical vulnerabilities in all of coreutils, then that seems pretty good to me. Rust itself has had 9 CVEs relating to memory safety in 2021 alone[0], which you can justify because Rust's development is highly active. https://www.cvedetails.com/vulnerability-list/vendor_id-19029/product_id-48677/year-2021/opov-1/Rust-lang-Rust.html https://www.cvedetails.com/vulnerability-list/vendor_id-1902...
    - steveklabnik 5y ago
      Recently there's been some folks "backfilling" CVEs. For example, the last one on that list was filed in 2021, but was fixed in 2015. The second to last one was filed in 2021, but was fixed in 2020.
      - ljm 5y ago
        What would motivate someone to do that? Sounds misleading to file a bunch of CVEs years after the fact.
        steveklabnik 5y ago
        The idea is, a lot of tooling relies on the CVE system to determine if a system is vulnerable, and so making sure that there is an actual CVE filed for every security bug is a good idea for the robustness of said tooling. At least, that's my understanding.

GhettoComputers 5y ago

From a performance standpoint I love love trying them and eagerly seeing if I can replace the GNU tools. Its like using musl over glibc.

bogwog 5y ago
What kind of performance issues are you running into with GNU tools?
- GhettoComputers 5y ago
  I installed rust implementations and they’re all just much faster