4 ms·

> I don't know why you think that serde_json isn't good enough and so 49 other JSON libraries will spring up Because I have some decades of experience. > I al

by pron 5y ago

> I don't know why you think that serde_json isn't good enough and so 49 other JSON libraries will spring up Because I have some decades of experience. > I also don't know why you're sure a programmer will decide they ought to write format!("\"{json_string}\"") but you're confident they would never write format!("\"{}\"", json_string). That's not my argument. I am not saying string formatting will make injection vulnerabilities more likely, but that it's a missed opportunity to make them less likely. You add a new feature because it's more convenient and attractive, and so you expect people to use it. If you know that feature touches on what's known to be one of the most dangerous aspects of programming, you might as well make it more convenient and safer, so that you attract programmers away from the less safe options and toward the safer ones.

tialaramex 5y ago
> Because I have some decades of experience. Is this decades of experience with Rust (from 2015) or decades of experience with JSON (from 2001) ? Or just decades of experience making implausible predictions? Here's how you make a JSON string in serde_rust here in 2022: let s = Value::String(myString); Here's how you propose programmers will erroneously try to make a JSON string in 2042 abusing the format macro: let s = format!("\"{myString}\""); Here's how I think programmers will successfully make JSON strings in 2042 using serde_json which is obviously the right tool for the job: let s = Value::String(myString);
- pron 5y ago
  Other typed languages, including those far more popular than Rust, have had libraries like serde — which are obviously the right tool for the job — for many years, and yet if 0.1% of their programmers make a mistake, that's enough to make it one of the most common and dangerous vulnerabilities. We know some programmers make that mistake because that's what security research shows, which is why the language and type system should reduce its chances. Are you saying that you're not worried about that 0.1% because you can be certain even one programmer in a thousand won't make such mistakes, or because you don't expect Rust to be popular enough for that number to matter?
  - tialaramex 5y ago
    So, what would you have them do? Do you even have an example of how you think general purpose formatters should be "safe" under your model of the world? You insist it should "validate" the strings but it's a general purpose formatter, there isn't anything to validate that isn't already mandatory in the language. Yes, if I take the SQL formatter and I use it to make email addresses that's more likely to incur dangerous vulnerabilities. This is not a defect in the SQL formatter, I am using the wrong tools. > Are you saying that you're not worried about that 0.1% because you can be certain even one programmer in a thousand won't make such mistakes, or because you don't expect Rust to be popular enough for that number to matter? I can't do anything about the fact that people will make grave logical errors when programming, beyond advocate for testing and code review which might catch those errors. I suspect your 0.1% figure is pulled out of your backside, but, sure, somebody will get it wrong. General purpose languages shouldn't be riddled with foot guns, but there's a difference between a language not having foot guns and not having any guns at all out of fear that somebody might shoot themselves despite the fact the gun was locked away, the ammo was locked away, and they had taken training in "How to use guns safely" before being given the keys. Again, if you fear strings you can use special-purpose languages which don't have any strings so that you can't possibly make this mistake. WUFFS is not a language for babies, with training wheels, it's a language for experts who know they don't need stuff like strings in the domain they're working on.
    - pron 5y ago
      > So, what would you have them do? Do you even have an example of how you think general purpose formatters should be "safe" under your model of the world? Yes. In my very first comment I posted a link to Java's upcoming feature, which uses the type system to ensure proper validation in a general-purpose string templating mechanism. Here it is again: https://openjdk.java.net/jeps/8273943 https://openjdk.java.net/jeps/8273943. As I also said in my first comment, our security experts were so concerned about this problem, which was empirically found to be one of the most dangerous programming operations in recent years (famously so among those interested in security), that they wouldn't let us add it to Java without a solution to the security problem > This is not a defect in the SQL formatter, I am using the wrong tools. But 1. people do use the wrong tools, which is why it's such a common and dangerous vulnerability, and 2. a typed language certainly can prevent that, as in my link. > I can't do anything about the fact that people will make grave logical errors when programming That's a strange position from a Rust user, especially as in this case there certainly is something the language can do. > I suspect your 0.1% figure is pulled out of your backside, but, sure, somebody will get it wrong. Pretty much all top security vulnerabilities lists list this problem near the top, and some languages are so popular (many millions of professional devs) that even 0.1% of their users are sufficient to make this problem a common one, deserving of its spot. So I figure that 0.1% is about the right number to make this a very common problem. > Again, if you fear strings you can use special-purpose languages which don't have any strings so that you can't possibly make this mistake. Or use Java's upcoming string templates. Or, if you prefer less popular languages, Scala, which uses a similar technique.

by pron 5y ago

tialaramex 5y ago

> Because I have some decades of experience. Is this decades of experience with Rust (from 2015) or decades of experience with JSON (from 2001) ? Or just decades of experience making implausible predictions? Here's how you make a JSON string in serde_rust here in 2022: let s = Value::String(myString); Here's how you propose programmers will erroneously try to make a JSON string in 2042 abusing the format macro: let s = format!("\"{myString}\""); Here's how I think programmers will successfully make JSON strings in 2042 using serde_json which is obviously the right tool for the job: let s = Value::String(myString);

pron 5y ago
Other typed languages, including those far more popular than Rust, have had libraries like serde — which are obviously the right tool for the job — for many years, and yet if 0.1% of their programmers make a mistake, that's enough to make it one of the most common and dangerous vulnerabilities. We know some programmers make that mistake because that's what security research shows, which is why the language and type system should reduce its chances. Are you saying that you're not worried about that 0.1% because you can be certain even one programmer in a thousand won't make such mistakes, or because you don't expect Rust to be popular enough for that number to matter?
- tialaramex 5y ago
  So, what would you have them do? Do you even have an example of how you think general purpose formatters should be "safe" under your model of the world? You insist it should "validate" the strings but it's a general purpose formatter, there isn't anything to validate that isn't already mandatory in the language. Yes, if I take the SQL formatter and I use it to make email addresses that's more likely to incur dangerous vulnerabilities. This is not a defect in the SQL formatter, I am using the wrong tools. > Are you saying that you're not worried about that 0.1% because you can be certain even one programmer in a thousand won't make such mistakes, or because you don't expect Rust to be popular enough for that number to matter? I can't do anything about the fact that people will make grave logical errors when programming, beyond advocate for testing and code review which might catch those errors. I suspect your 0.1% figure is pulled out of your backside, but, sure, somebody will get it wrong. General purpose languages shouldn't be riddled with foot guns, but there's a difference between a language not having foot guns and not having any guns at all out of fear that somebody might shoot themselves despite the fact the gun was locked away, the ammo was locked away, and they had taken training in "How to use guns safely" before being given the keys. Again, if you fear strings you can use special-purpose languages which don't have any strings so that you can't possibly make this mistake. WUFFS is not a language for babies, with training wheels, it's a language for experts who know they don't need stuff like strings in the domain they're working on.
  - pron 5y ago
    > So, what would you have them do? Do you even have an example of how you think general purpose formatters should be "safe" under your model of the world? Yes. In my very first comment I posted a link to Java's upcoming feature, which uses the type system to ensure proper validation in a general-purpose string templating mechanism. Here it is again: https://openjdk.java.net/jeps/8273943 https://openjdk.java.net/jeps/8273943. As I also said in my first comment, our security experts were so concerned about this problem, which was empirically found to be one of the most dangerous programming operations in recent years (famously so among those interested in security), that they wouldn't let us add it to Java without a solution to the security problem > This is not a defect in the SQL formatter, I am using the wrong tools. But 1. people do use the wrong tools, which is why it's such a common and dangerous vulnerability, and 2. a typed language certainly can prevent that, as in my link. > I can't do anything about the fact that people will make grave logical errors when programming That's a strange position from a Rust user, especially as in this case there certainly is something the language can do. > I suspect your 0.1% figure is pulled out of your backside, but, sure, somebody will get it wrong. Pretty much all top security vulnerabilities lists list this problem near the top, and some languages are so popular (many millions of professional devs) that even 0.1% of their users are sufficient to make this problem a common one, deserving of its spot. So I figure that 0.1% is about the right number to make this a very common problem. > Again, if you fear strings you can use special-purpose languages which don't have any strings so that you can't possibly make this mistake. Or use Java's upcoming string templates. Or, if you prefer less popular languages, Scala, which uses a similar technique.