5 ms·
It probably depends on project type and how complex your ownership models are, but that doesn't really track with large projects having a majority of their CVEs
by vgel 4y ago
It probably depends on project type and how complex your ownership models are, but that doesn't really track with large projects having a majority of their CVEs be memory safety issues that are far less likely in Rust[1] (e.g., https://www.chromium.org/Home/chromium-security/memory-safety/ https://www.chromium.org/Home/chromium-security/memory-safet...)
[1] I say far less likely because obviously it's possible with unsafe Rust, but I've never had one happen, seen one happen in real code, or been affected by part of a dependency tree having one.
- lelanthran 4y agoI'm not saying that a large number of CVEs won't be prevented in Rust, I'm saying that so few bugs are CVEs that the trade-off is not always worth it. If you have 1000s of bug reports, of which 5 are CVEs, and then have 3 of those 5 be preventable, most dev teams are still going to consider the cost/benefit of going through the pain of developing a long-term product in Rust, or of switching to Rust altogether.
- bschwindHN 4y ago> of which 5 are CVEs Those 5 are just the ones you know about...
- lelanthran 4y ago> Those 5 are just the ones you know about... It's pointless making a cost/benefit analysis on things that probably don't exist.
- girvo 4y agoI suppose it comes down to risk assessment; if those CVEs are critical “fix this now or the world catches fire”, then their relative infrequency seems to be outweighed by their impact, no?
- lelanthran 4y ago> I suppose it comes down to risk assessment; if those CVEs are critical “fix this now or the world catches fire”, then their relative infrequency seems to be outweighed by their impact, no? No.
- snovv_crash 4y agoCVEs are a tiny, tiny fraction of bugs.