3 ms·

Other typed languages, including those far more popular than Rust, have had libraries like serde — which are obviously the right tool for the job — for many yea

by pron 5y ago

Other typed languages, including those far more popular than Rust, have had libraries like serde — which are obviously the right tool for the job — for many years, and yet if 0.1% of their programmers make a mistake, that's enough to make it one of the most common and dangerous vulnerabilities. We know some programmers make that mistake because that's what security research shows, which is why the language and type system should reduce its chances. Are you saying that you're not worried about that 0.1% because you can be certain even one programmer in a thousand won't make such mistakes, or because you don't expect Rust to be popular enough for that number to matter?

tialaramex 5y ago
So, what would you have them do? Do you even have an example of how you think general purpose formatters should be "safe" under your model of the world? You insist it should "validate" the strings but it's a general purpose formatter, there isn't anything to validate that isn't already mandatory in the language. Yes, if I take the SQL formatter and I use it to make email addresses that's more likely to incur dangerous vulnerabilities. This is not a defect in the SQL formatter, I am using the wrong tools. > Are you saying that you're not worried about that 0.1% because you can be certain even one programmer in a thousand won't make such mistakes, or because you don't expect Rust to be popular enough for that number to matter? I can't do anything about the fact that people will make grave logical errors when programming, beyond advocate for testing and code review which might catch those errors. I suspect your 0.1% figure is pulled out of your backside, but, sure, somebody will get it wrong. General purpose languages shouldn't be riddled with foot guns, but there's a difference between a language not having foot guns and not having any guns at all out of fear that somebody might shoot themselves despite the fact the gun was locked away, the ammo was locked away, and they had taken training in "How to use guns safely" before being given the keys. Again, if you fear strings you can use special-purpose languages which don't have any strings so that you can't possibly make this mistake. WUFFS is not a language for babies, with training wheels, it's a language for experts who know they don't need stuff like strings in the domain they're working on.
- pron 5y ago
  > So, what would you have them do? Do you even have an example of how you think general purpose formatters should be "safe" under your model of the world? Yes. In my very first comment I posted a link to Java's upcoming feature, which uses the type system to ensure proper validation in a general-purpose string templating mechanism. Here it is again: https://openjdk.java.net/jeps/8273943 https://openjdk.java.net/jeps/8273943. As I also said in my first comment, our security experts were so concerned about this problem, which was empirically found to be one of the most dangerous programming operations in recent years (famously so among those interested in security), that they wouldn't let us add it to Java without a solution to the security problem > This is not a defect in the SQL formatter, I am using the wrong tools. But 1. people do use the wrong tools, which is why it's such a common and dangerous vulnerability, and 2. a typed language certainly can prevent that, as in my link. > I can't do anything about the fact that people will make grave logical errors when programming That's a strange position from a Rust user, especially as in this case there certainly is something the language can do. > I suspect your 0.1% figure is pulled out of your backside, but, sure, somebody will get it wrong. Pretty much all top security vulnerabilities lists list this problem near the top, and some languages are so popular (many millions of professional devs) that even 0.1% of their users are sufficient to make this problem a common one, deserving of its spot. So I figure that 0.1% is about the right number to make this a very common problem. > Again, if you fear strings you can use special-purpose languages which don't have any strings so that you can't possibly make this mistake. Or use Java's upcoming string templates. Or, if you prefer less popular languages, Scala, which uses a similar technique.
  - tialaramex 5y ago
    But that JEP doesn't actually provide the safe general purpose formatter you're insisting Rust should have built here. The exact same programmer who you insist will write format!("\"{myString}\""); // in Rust will also write: CONCAT."\"\{myString}\""; // in Java with this JEP The JEP argues that it'll be all OK when Steiner attacks^W^W^W so long as you only use the potentially tainted "strings" via an API which doesn't allow general string objects. But, that's also the exact situation you've dismissed as unable to prevent abuse in Rust. Java can't stop you writing your supposedly "JSON" data made with CONCAT to a file or over a network socket, and Rust can't stop you writing some made with format! either, it's just data, who knows why you wanted to write this or that gibberish? According to you we should expect 0.1% of the "safe" Java using these templates to be vulnerable.

by pron 5y ago

tialaramex 5y ago

So, what would you have them do? Do you even have an example of how you think general purpose formatters should be "safe" under your model of the world? You insist it should "validate" the strings but it's a general purpose formatter, there isn't anything to validate that isn't already mandatory in the language. Yes, if I take the SQL formatter and I use it to make email addresses that's more likely to incur dangerous vulnerabilities. This is not a defect in the SQL formatter, I am using the wrong tools. > Are you saying that you're not worried about that 0.1% because you can be certain even one programmer in a thousand won't make such mistakes, or because you don't expect Rust to be popular enough for that number to matter? I can't do anything about the fact that people will make grave logical errors when programming, beyond advocate for testing and code review which might catch those errors. I suspect your 0.1% figure is pulled out of your backside, but, sure, somebody will get it wrong. General purpose languages shouldn't be riddled with foot guns, but there's a difference between a language not having foot guns and not having any guns at all out of fear that somebody might shoot themselves despite the fact the gun was locked away, the ammo was locked away, and they had taken training in "How to use guns safely" before being given the keys. Again, if you fear strings you can use special-purpose languages which don't have any strings so that you can't possibly make this mistake. WUFFS is not a language for babies, with training wheels, it's a language for experts who know they don't need stuff like strings in the domain they're working on.

pron 5y ago
> So, what would you have them do? Do you even have an example of how you think general purpose formatters should be "safe" under your model of the world? Yes. In my very first comment I posted a link to Java's upcoming feature, which uses the type system to ensure proper validation in a general-purpose string templating mechanism. Here it is again: https://openjdk.java.net/jeps/8273943 https://openjdk.java.net/jeps/8273943. As I also said in my first comment, our security experts were so concerned about this problem, which was empirically found to be one of the most dangerous programming operations in recent years (famously so among those interested in security), that they wouldn't let us add it to Java without a solution to the security problem > This is not a defect in the SQL formatter, I am using the wrong tools. But 1. people do use the wrong tools, which is why it's such a common and dangerous vulnerability, and 2. a typed language certainly can prevent that, as in my link. > I can't do anything about the fact that people will make grave logical errors when programming That's a strange position from a Rust user, especially as in this case there certainly is something the language can do. > I suspect your 0.1% figure is pulled out of your backside, but, sure, somebody will get it wrong. Pretty much all top security vulnerabilities lists list this problem near the top, and some languages are so popular (many millions of professional devs) that even 0.1% of their users are sufficient to make this problem a common one, deserving of its spot. So I figure that 0.1% is about the right number to make this a very common problem. > Again, if you fear strings you can use special-purpose languages which don't have any strings so that you can't possibly make this mistake. Or use Java's upcoming string templates. Or, if you prefer less popular languages, Scala, which uses a similar technique.
- tialaramex 5y ago
  But that JEP doesn't actually provide the safe general purpose formatter you're insisting Rust should have built here. The exact same programmer who you insist will write format!("\"{myString}\""); // in Rust will also write: CONCAT."\"\{myString}\""; // in Java with this JEP The JEP argues that it'll be all OK when Steiner attacks^W^W^W so long as you only use the potentially tainted "strings" via an API which doesn't allow general string objects. But, that's also the exact situation you've dismissed as unable to prevent abuse in Rust. Java can't stop you writing your supposedly "JSON" data made with CONCAT to a file or over a network socket, and Rust can't stop you writing some made with format! either, it's just data, who knows why you wanted to write this or that gibberish? According to you we should expect 0.1% of the "safe" Java using these templates to be vulnerable.