6 ms·

This is naive. You cannot rewrite the entirety of the Linux kernel in another language overnight. You'd have years at least until it becomes production-ready.

This is naive. You cannot rewrite the entirety of the Linux kernel in another language overnight. You'd have years at least until it becomes production-ready. Not to mention the performance and memory use will be worse. Certainly the situation can and should be better, but adopting this "it's so easy, how does nobody see it?" attitude helps no one.

green_on_black 4y ago
I mostly agree, but I think I would have read the comment differently. I've seen C++ people have a strong distaste towards Rust for various reasons and don't exactly care too much about the "memory safety" part. Which is... unfortunate. So while it might be "beating a dead horse", the horse isn't even dead.
- hardware2win 4y ago
  You're right. People need to be aware how mem. safety affects security in critical software like Chromium or Microsoft's.
- AshamedCaptain 4y ago
  In fairness, a shitton of these issues would be solved by following C++ patterns like RAII, instead of the defer/gotos style the kernel seems to be proud of.
- kramerger 4y ago
  This is kernel space, not userspace. Rusts memory safety is not a 100% protection here.
  - AshamedCaptain 4y ago
    Rust's memory safety is never a 100% thing, but that is no argument, as long as it's a significant enough improvement...
    - kramerger 4y ago
      Let me explain: in the kernel memory is not always simply "memory". Sometimes writing to a memory you own has huge side effects. And that part is not handled by rust.
- e2le 4y ago
  Perhaps instead we could train an ML model to find these use-after-free bugs?
hardware2win 4y ago
>Not to mention the performance and memory use will be worse. How much?
UncleMeat 4y ago
You obviously cannot rewrite things in another language overnight. But I do wish that the industry saw this as an emergency rather than something ranging from "well, we will get to it when we get to it" to "ugh, I'm tired of these people talking about memory safety - don't you know that you can write correct C programs?" The linux kernel in particular is perhaps the single most important piece of software on the planet. And we vulns like this all the time. Hundreds per year. And there's billions more lines of C and C++ out there handling all sorts of untrusted input. The path off C and C++ is complicated as shit. Interop with Rust is messy and there aren't effective tools for automatic translation. Carbon is barely a language at this point (they don't even have a compiler) and doesn't yet provide safety. The story for the other alternative languages isn't any better. But I really wish the industry was throwing billions at this across dozens of major companies and open source organizations.
- ff317 4y ago
  Rust is not a panacea. You can't just claim that this one emergency project somehow solves all the future bugs. Would Linux being rewritten in mostly-Rust help with some classes of memory bugs some of the time? Sure. Would there be a lot of other tradeoffs to consider, are there risks, would there still be plenty of kernel CVEs going forward? Yes to all of these.
  - UncleMeat 4y ago
    Rust is absolutely not a panacea. Other kinds of vulns can absolutely exist. But vulns caused by memory-safety errors are so incredibly common in Linux and other critical software that it should be embarrassing. If we could get to a world where all of our kernel-level vulns were logical errors rather than UAFs I would weep with joy. I'm not saying that using memory-safe languages (or a different kernel design that at least isolates bugs like this) fixes security forever. I'm saying that it would dramatically increase the cost of developing an exploit for the world's most important piece of software. I'll even soften my request. Let's forget about memory safety. Let's just talk about regression tests. How the fuck is it possible for a vuln to regress in the kernel because nobody added a test when it was first fixed? This is a disaster. Everybody has just somehow decided that the current state of things is tolerable and I feel like I'm taking crazy pills.

green_on_black 4y ago

I mostly agree, but I think I would have read the comment differently. I've seen C++ people have a strong distaste towards Rust for various reasons and don't exactly care too much about the "memory safety" part. Which is... unfortunate. So while it might be "beating a dead horse", the horse isn't even dead.

hardware2win 4y ago
You're right. People need to be aware how mem. safety affects security in critical software like Chromium or Microsoft's.
AshamedCaptain 4y ago
In fairness, a shitton of these issues would be solved by following C++ patterns like RAII, instead of the defer/gotos style the kernel seems to be proud of.
kramerger 4y ago
This is kernel space, not userspace. Rusts memory safety is not a 100% protection here.
- AshamedCaptain 4y ago
  Rust's memory safety is never a 100% thing, but that is no argument, as long as it's a significant enough improvement...
  - kramerger 4y ago
    Let me explain: in the kernel memory is not always simply "memory". Sometimes writing to a memory you own has huge side effects. And that part is not handled by rust.
e2le 4y ago
Perhaps instead we could train an ML model to find these use-after-free bugs?

hardware2win 4y ago

>Not to mention the performance and memory use will be worse. How much?

UncleMeat 4y ago

You obviously cannot rewrite things in another language overnight. But I do wish that the industry saw this as an emergency rather than something ranging from "well, we will get to it when we get to it" to "ugh, I'm tired of these people talking about memory safety - don't you know that you can write correct C programs?" The linux kernel in particular is perhaps the single most important piece of software on the planet. And we vulns like this all the time. Hundreds per year. And there's billions more lines of C and C++ out there handling all sorts of untrusted input. The path off C and C++ is complicated as shit. Interop with Rust is messy and there aren't effective tools for automatic translation. Carbon is barely a language at this point (they don't even have a compiler) and doesn't yet provide safety. The story for the other alternative languages isn't any better. But I really wish the industry was throwing billions at this across dozens of major companies and open source organizations.

ff317 4y ago
Rust is not a panacea. You can't just claim that this one emergency project somehow solves all the future bugs. Would Linux being rewritten in mostly-Rust help with some classes of memory bugs some of the time? Sure. Would there be a lot of other tradeoffs to consider, are there risks, would there still be plenty of kernel CVEs going forward? Yes to all of these.
- UncleMeat 4y ago
  Rust is absolutely not a panacea. Other kinds of vulns can absolutely exist. But vulns caused by memory-safety errors are so incredibly common in Linux and other critical software that it should be embarrassing. If we could get to a world where all of our kernel-level vulns were logical errors rather than UAFs I would weep with joy. I'm not saying that using memory-safe languages (or a different kernel design that at least isolates bugs like this) fixes security forever. I'm saying that it would dramatically increase the cost of developing an exploit for the world's most important piece of software. I'll even soften my request. Let's forget about memory safety. Let's just talk about regression tests. How the fuck is it possible for a vuln to regress in the kernel because nobody added a test when it was first fixed? This is a disaster. Everybody has just somehow decided that the current state of things is tolerable and I feel like I'm taking crazy pills.