5 ms·

This is one class of bugs that would not exist if V8 was written in Rust.

by thekashifmalik 5y ago

jgaa 5y ago
This is one class of bugs that would not exist if javascript was banned.
- tomjen3 5y ago
  Javascript isn't to blame: bad C++ is. It is 2021 and if you are not putting things in smart pointers, you are doing it wrong.
  - olliej 5y ago
    If it’s a bug in V8 it’s likely either GC or codegen, no amount of smart pointers gets you to being completely safe, but the same applies to all the “safe” languages as well.
  - jgaa 5y ago
    js is the new flash. It's just as annoying, and it's the way bad people do bad things to your computer.
    - catfishx 5y ago
      I cant believe you are comparing JavaScript to flash
olliej 5y ago
Unlikely - JS engines do a lot of things that are inherently unsafe - pretty much anything related to garbage collection isn’t doable outside of unsafe{} blocks in rust, which as you might guess are unsafe. I can’t speak for V8, but the majority of UaF in JSC have been due to GC bugs collecting objects early. Being in C++ isn’t relevant. Many other bugs are in things that are doing absurd memory manipulation needed for execution speed of common primitives. The rust implementation of these would also necessarily be unsafe.
- staticassertion 5y ago
  I'd be interested in hearing from others on this, but typically the way that "inherently unsafe Thing" gets done in rust is that you have an unsafe layer wrapped in a safe layer. The problem is obviously building the safe layer. Sometimes that's really hard. There are obvious examples already in Rust - like creating a safe API over scoped threads, or io_uring, ghostcells, etc. Some things may not be representable using only safe code in Rust, with no overhead. Another relevant thing you can't really safely express is FFI. That would be relevant here since there's this VM boundary. And then you get JITs, which also have tons of security issues. Idk, I'd be curious to read about this if there are any papers. Maybe the wasm people are thinking about this? Certainly it's not unreasonable to say that a memory safe JIT'd VM is going to be tough make memory safe.

This is one class of bugs that would not exist if V8 was written in Rust.

jgaa 5y ago

This is one class of bugs that would not exist if javascript was banned.

tomjen3 5y ago
Javascript isn't to blame: bad C++ is. It is 2021 and if you are not putting things in smart pointers, you are doing it wrong.
- olliej 5y ago
  If it’s a bug in V8 it’s likely either GC or codegen, no amount of smart pointers gets you to being completely safe, but the same applies to all the “safe” languages as well.
- jgaa 5y ago
  js is the new flash. It's just as annoying, and it's the way bad people do bad things to your computer.
  - catfishx 5y ago
    I cant believe you are comparing JavaScript to flash

olliej 5y ago

Unlikely - JS engines do a lot of things that are inherently unsafe - pretty much anything related to garbage collection isn’t doable outside of unsafe{} blocks in rust, which as you might guess are unsafe. I can’t speak for V8, but the majority of UaF in JSC have been due to GC bugs collecting objects early. Being in C++ isn’t relevant. Many other bugs are in things that are doing absurd memory manipulation needed for execution speed of common primitives. The rust implementation of these would also necessarily be unsafe.

staticassertion 5y ago
I'd be interested in hearing from others on this, but typically the way that "inherently unsafe Thing" gets done in rust is that you have an unsafe layer wrapped in a safe layer. The problem is obviously building the safe layer. Sometimes that's really hard. There are obvious examples already in Rust - like creating a safe API over scoped threads, or io_uring, ghostcells, etc. Some things may not be representable using only safe code in Rust, with no overhead. Another relevant thing you can't really safely express is FFI. That would be relevant here since there's this VM boundary. And then you get JITs, which also have tons of security issues. Idk, I'd be curious to read about this if there are any papers. Maybe the wasm people are thinking about this? Certainly it's not unreasonable to say that a memory safe JIT'd VM is going to be tough make memory safe.