3 ms·

So they are going to teach a process to consistently make and deliver high assurance, robust systems written in Rust when they knowingly claim that they have ne

by Veserv 5y ago

So they are going to teach a process to consistently make and deliver high assurance, robust systems written in Rust when they knowingly claim that they have never even heard of, let alone made, even a single high assurance, robust system in Rust. This is absolutely ridiculous. Having a process for making high assurance, robust systems is a extraordinary claim which requires the extraordinary evidence of repeated success at delivering such systems in real-life adversarial environments and succeeding at audits and verification efforts that are demonstrably passed only by robust systems. Anybody who has not reached that standard should not use the words “high assurance”, “robust”, or “secure” as they have no evidence of their claims and anything they say should be completely, 100% ignored. It is frankly outrageous that people so far from that standard that they can not even point to a single system that anybody has done have the gall to use those words.

woodruffw 5y ago
"Secure," "robust," "high-assurance," etc. are not standard terms with a single agreed upon definition. Like just about anything that concerns computer security, their definitions depend on threat models and maybe a domain-specific specification. I don't particularly care whether a particular flavor of Rust (or C, for that matter) brands itself as "high-assurance," as long as it is not dishonestly claiming compliance with a particular domain's assurance or robustness requirements.
throwawaygh 5y ago
> when they knowingly claim that they have never even heard of, let alone made, even a single high assurance, robust system in Rust. Huh?! They said you can't build safety-critical software in Rust because it's not certified. Not all high assurance software is safety-critical, not all correct software is certifiable, and FOR SURE not all certifiable software is correct. > evidence of repeated success at delivering such systems in real-life adversarial environments and succeeding at audits and verification efforts that are demonstrably passed only by robust systems. Can you name one such process? The old auto and aero software standards from the 90s/early aughts are crufty, have demonstrably failed on any number of occasions, and leave much to be desired. (BTW, "verification" in those standards means something totally different from what "verification" means to software experts today.) The Rust compiler and ecosystem would need a thorough audit before its use in safety-critical settings, but I have no doubt that this audit will happen and that when it does the evidence generated y that audit will blow way past the standards applied to MISRA C/Ada/etc.

by Veserv 5y ago

woodruffw 5y ago

"Secure," "robust," "high-assurance," etc. are not standard terms with a single agreed upon definition. Like just about anything that concerns computer security, their definitions depend on threat models and maybe a domain-specific specification. I don't particularly care whether a particular flavor of Rust (or C, for that matter) brands itself as "high-assurance," as long as it is not dishonestly claiming compliance with a particular domain's assurance or robustness requirements.

throwawaygh 5y ago

> when they knowingly claim that they have never even heard of, let alone made, even a single high assurance, robust system in Rust. Huh?! They said you can't build safety-critical software in Rust because it's not certified. Not all high assurance software is safety-critical, not all correct software is certifiable, and FOR SURE not all certifiable software is correct. > evidence of repeated success at delivering such systems in real-life adversarial environments and succeeding at audits and verification efforts that are demonstrably passed only by robust systems. Can you name one such process? The old auto and aero software standards from the 90s/early aughts are crufty, have demonstrably failed on any number of occasions, and leave much to be desired. (BTW, "verification" in those standards means something totally different from what "verification" means to software experts today.) The Rust compiler and ecosystem would need a thorough audit before its use in safety-critical settings, but I have no doubt that this audit will happen and that when it does the evidence generated y that audit will blow way past the standards applied to MISRA C/Ada/etc.