4 ms·

I don't believe that the change to rust (and I like rust a a lot) will lead to a measurably more secure kernel in the long term, although it will mean that main

I don't believe that the change to rust (and I like rust a a lot) will lead to a measurably more secure kernel in the long term, although it will mean that maintaining the kernel will require knowledge of Rust in addition to C (and some flavors of assembly, occasionally). On top of that, the Rust that can be compiled into the kernel will be a subset, or its compilation will be tuned [idiomatic and safe allocation of memory within the stack, efficient Rust/C interoperability with dynamically allocated memory, in a Rust-safe way, etc.]. Let me explain why I think that: In the short term, having more eyes looking at and re-implementing the scaffolding for drivers and the drivers themselves will certainly lead to a very positive outcome - many potential bugs (of which, most of them will not really be exploitable, but some will) will be uncovered which couldn't have been introduced with safe Rust. However, at some point, the coolness factor will drop, drivers will become fossilized, a larger developer base that has to maintain older Rust drivers might cut corners, use more unsafe features, misunderstand/misremember the nuances of this or that, and what was once exciting is now tedious. Maybe not, maybe Rust will slowly replace the whole kernel, however, at the current stage at which Linux is, I find it unlikely (but possible).

nicoburns 5y ago
> a larger developer base that has to maintain older Rust drivers might cut corners, use more unsafe features, misunderstand/misremember the nuances of this or that, and what was once exciting is now tedious. The great thing about Rust is that it makes it much harder to cut corners, and much more obvious when someone does (making it easier to pick up at review stage). Invariants can be built into APIs in a way that simply can't be done in C.
tialaramex 5y ago
But the Rust safety guarantees aren't about eyeballs, they're about boring mechanical processes, the same difference as say, having your CI run unit tests and refuse to provide artefacts if the tests fail versus telling developers "Make sure you run the tests before shipping a release" which they will promptly forget to do. The machine doesn't get bored. The fact Rust may not be "cool" any more doesn't alter the fact that your subsystem maintainer isn't going to accept your patch that doesn't compile because you tried to take the lock for foo, but then used locked variable bar - something C has no problem with but which in Rust of course does not compile.

nicoburns 5y ago

> a larger developer base that has to maintain older Rust drivers might cut corners, use more unsafe features, misunderstand/misremember the nuances of this or that, and what was once exciting is now tedious. The great thing about Rust is that it makes it much harder to cut corners, and much more obvious when someone does (making it easier to pick up at review stage). Invariants can be built into APIs in a way that simply can't be done in C.

tialaramex 5y ago

But the Rust safety guarantees aren't about eyeballs, they're about boring mechanical processes, the same difference as say, having your CI run unit tests and refuse to provide artefacts if the tests fail versus telling developers "Make sure you run the tests before shipping a release" which they will promptly forget to do. The machine doesn't get bored. The fact Rust may not be "cool" any more doesn't alter the fact that your subsystem maintainer isn't going to accept your patch that doesn't compile because you tried to take the lock for foo, but then used locked variable bar - something C has no problem with but which in Rust of course does not compile.