4 ms·

Can you explain why, in spite of the fact that (according to you) C & C++ aren't that unsafe, critical projects like Chromium can't get this right? https://twit

Can you explain why, in spite of the fact that (according to you) C & C++ aren't that unsafe, critical projects like Chromium can't get this right? https://twitter.com/pcwalton/status/1539112080590217217 https://twitter.com/pcwalton/status/1539112080590217217 Is the Project Zero team just too lazy to remind Chromium to use sanitizers?

uecker 4y ago
I think the big question is, whether two teams writing software on a fixed budget using Rust or C using modern tools and best practices would end up with a safer product. I think this is not clear at all.
- uecker 4y ago
  (Ok, I should read the text before sending.)
- pcwalton 4y ago
  People have done just that with, for example, Firefox components and found that yes, Rust gives you a safer product.
  - uecker 4y ago
    Do you have a pointer? I know they rewrote Firefox components, but I am not aware of a real study with a 1:1 comparison.
- lmm 4y ago
  I think it's very clear for anything other than a no-true-Scotsman definition of "modern tools and best practices" (which is sadly the only one that seems to exist).
jerf 4y ago
While I'm generally in favor of the proposition that C++ is an intrinsically dangerous language, pointing at one of the largest possible projects that uses it isn't the best argument. If I pushed a button and magically for free Chrome was suddenly in 100% pure immaculate Rust, I'm sure it would still have many issues and problems that few other projects would have, just due to its sheer scale. I would still consider it an open question/problem as to whether Rust can scale up to that size and still be something that humans can modify. I could make a solid case that the difficulty of working in Rust would very accurately reflect a true and essential difficulty of working at that scale in general, but it could still be a problem. (Also Rust defenders please note I'm not saying Rust can't work at that scale. I'm just saying, it's a very big scale and I think it's an open problem. My personal opinion and gut say yes, it shouldn't be any worse than it has to be because of the sheer size (that is, the essential complexity is pretty significant no matter what you do), but I don't know that.)
- hyperpape 4y ago
  You're right that Chromium* is a very difficult task, but I disagree with the conclusion you draw. I think Chromium is one of the best examples we can consider. There would absolutely be issues, including security issues. But there is also very good evidence that the issues that are most exploited in browsers and operating systems relate to memory safety. Alex Gaynor's piece that the author linked is good on this point. While securing Chromium is huge and a difficult task, it and consumer operating systems are crucial for individual security. Until browsers and consumer operating systems are secure, individuals ranging from persecuted political dissidents to Jeff Bezos won't be secure. * Actually not sure why I said Chromium rather than Chrome. Nothing hangs on the distinction, afaict.
ArrayBoundCheck 4y ago
Considering how much I got downvoted no I don't want to comment more about this. But I'll let you ponder why while using rust has you could get a use after free sometimes https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45720 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4572...
- hyperpape 4y ago
  Here's the commit: https://github.com/jeromefroe/lru-rs/pull/121/commits/416a2d480547f6b88ef6d23aa34b1fea292f65fb https://github.com/jeromefroe/lru-rs/pull/121/commits/416a2d.... I don't think this does much for your initial claim. Take the most generous reading you can--Rust isn't any better at preventing UAF than C/C++. That doesn't make safe C/C++ a thing, it means that Rust isn't an appropriate solution.
  - ArrayBoundCheck 4y ago
    You missed the point. Just like the author did when he disqualified all the C++ tools Writing unsafe code and removing tools "because production" gets you unsafe code as shown in that rust cve
    - XelNika 4y ago
      With Zig and Rust you have to explicitly opt-out with `ReleaseFast` and `unsafe` respectively, that makes a big difference. Rust has the added safety that you cannot (to my knowledge at least) gain performance by opting out with a flag at compile-time, it has to be done with optimized `unsafe` blocks directly in the code. Lazy C++ is unsafe, lazy Zig is safe-ish, lazy Rust is safe. Given how lazy most programmers are, I consider that a strong argument against C++.
      - ArrayBoundCheck 4y ago
        [dead]
        4y ago

uecker 4y ago

I think the big question is, whether two teams writing software on a fixed budget using Rust or C using modern tools and best practices would end up with a safer product. I think this is not clear at all.

uecker 4y ago
(Ok, I should read the text before sending.)
pcwalton 4y ago
People have done just that with, for example, Firefox components and found that yes, Rust gives you a safer product.
- uecker 4y ago
  Do you have a pointer? I know they rewrote Firefox components, but I am not aware of a real study with a 1:1 comparison.
lmm 4y ago
I think it's very clear for anything other than a no-true-Scotsman definition of "modern tools and best practices" (which is sadly the only one that seems to exist).

jerf 4y ago

While I'm generally in favor of the proposition that C++ is an intrinsically dangerous language, pointing at one of the largest possible projects that uses it isn't the best argument. If I pushed a button and magically for free Chrome was suddenly in 100% pure immaculate Rust, I'm sure it would still have many issues and problems that few other projects would have, just due to its sheer scale. I would still consider it an open question/problem as to whether Rust can scale up to that size and still be something that humans can modify. I could make a solid case that the difficulty of working in Rust would very accurately reflect a true and essential difficulty of working at that scale in general, but it could still be a problem. (Also Rust defenders please note I'm not saying Rust can't work at that scale. I'm just saying, it's a very big scale and I think it's an open problem. My personal opinion and gut say yes, it shouldn't be any worse than it has to be because of the sheer size (that is, the essential complexity is pretty significant no matter what you do), but I don't know that.)

hyperpape 4y ago
You're right that Chromium* is a very difficult task, but I disagree with the conclusion you draw. I think Chromium is one of the best examples we can consider. There would absolutely be issues, including security issues. But there is also very good evidence that the issues that are most exploited in browsers and operating systems relate to memory safety. Alex Gaynor's piece that the author linked is good on this point. While securing Chromium is huge and a difficult task, it and consumer operating systems are crucial for individual security. Until browsers and consumer operating systems are secure, individuals ranging from persecuted political dissidents to Jeff Bezos won't be secure. * Actually not sure why I said Chromium rather than Chrome. Nothing hangs on the distinction, afaict.

ArrayBoundCheck 4y ago

Considering how much I got downvoted no I don't want to comment more about this. But I'll let you ponder why while using rust has you could get a use after free sometimes https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45720 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4572...

hyperpape 4y ago
Here's the commit: https://github.com/jeromefroe/lru-rs/pull/121/commits/416a2d480547f6b88ef6d23aa34b1fea292f65fb https://github.com/jeromefroe/lru-rs/pull/121/commits/416a2d.... I don't think this does much for your initial claim. Take the most generous reading you can--Rust isn't any better at preventing UAF than C/C++. That doesn't make safe C/C++ a thing, it means that Rust isn't an appropriate solution.
- ArrayBoundCheck 4y ago
  You missed the point. Just like the author did when he disqualified all the C++ tools Writing unsafe code and removing tools "because production" gets you unsafe code as shown in that rust cve
  - XelNika 4y ago
    With Zig and Rust you have to explicitly opt-out with `ReleaseFast` and `unsafe` respectively, that makes a big difference. Rust has the added safety that you cannot (to my knowledge at least) gain performance by opting out with a flag at compile-time, it has to be done with optimized `unsafe` blocks directly in the code. Lazy C++ is unsafe, lazy Zig is safe-ish, lazy Rust is safe. Given how lazy most programmers are, I consider that a strong argument against C++.
    - ArrayBoundCheck 4y ago
      [dead]
      - 4y ago