4 ms·
> I'd say making buffer overflow and UAF CVEs Just Go Away -- forever -- is a DAMN good reason to switch to Rust. rocket Crate up to 0.4.6 on Rust uri::Formatt
by fivea 5y ago
> I'd say making buffer overflow and UAF CVEs Just Go Away -- forever -- is a DAMN good reason to switch to Rust.
rocket Crate up to 0.4.6 on Rust uri::Formatter use after free
https://vuldb.com/?id.172079 https://vuldb.com/?id.172079
If only people stopped with the cargo cult nonsense that leads to this absurd belief that adopting a tool is a silver bullet to fix their sloppy practices.
- mrich 5y agoYou know, seeing one of the few existing Rust CVEs, which is a freak case, hard to exploit - makes me directly want to go back to the language family with the majority of the CVEs assigned. The existence of CVE itself arguably is a result of unsafe C/C++.
- fivea 5y ago> You know, seeing one of the few existing Rust CVEs (...) It is a real world CVE of use-after-free on real world Rust code in production. This demonstrates that, unlike claims from fanboys, mindlessly migrating to Rust does not magically make your code safe and immune to vulnerabilities such as use-after-free, and just like with any other language you still need to know what you are doing.