8 ms·

Is this “just” a 20% project or is this more significant (like Android one day supporting Rust to develop apps)? And I haven’t looked at everything yet, but it

by 1f60c 4y ago

Is this “just” a 20% project or is this more significant (like Android one day supporting Rust to develop apps)? And I haven’t looked at everything yet, but it suggests to install Rust like this: sudo apt install cargo rust-src While everyone I know uses rustup^: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh ^ https://rustup.rs/ https://rustup.rs/

schipplock 4y ago
They mention rustup on the 3rd slide.
rob74 4y ago
They're using Rust in the android system: https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html https://security.googleblog.com/2022/12/memory-safe-language...
est31 4y ago
> Is this “just” a 20% project or is this more significant (like Android one day supporting Rust to develop apps)? Android already uses Rust internally, in fact for new code it's a major language. They have made this guide to teach Rust to their engineers working on Android, according to this post on reddit: https://old.reddit.com/r/rust/comments/zrs1of/new_rust_course_by_android_comprehensive_rust/j14dgu3/ https://old.reddit.com/r/rust/comments/zrs1of/new_rust_cours...
ohbtvz 4y ago
I'm tired of installation instructions that consist of "curl | sh". Especially since this one just tries to detect the platform and downloads the correct installer for me. I know what platform I'm running, and I don't want to pipe the internet to my shell. In the end this is unpacking a tarball in ~/.rustup, I don't need the risk of running some bespoke script for that.
- est31 4y ago
  On some distros you can install rustup directly, e.g. NixOS or Arch. For Ubuntu, it's sadly not in the default repositories, but there is a snap for rustup uploaded by the rustup maintainer. https://pkgs.org/search/?q=rustup https://pkgs.org/search/?q=rustup https://snapcraft.io/rustup https://snapcraft.io/rustup
- kibwen 4y ago
  Since the ultimate objective is to run a binary blob that you just downloaded off of the internet, piping a script to your shell over HTTPS adds no additional attack surface.
  - mhoad 4y ago
    I get what you are trying to say here but I could also make the argument that you actually doubled it because now you have to trust two things rather than one. Depending on how you want to consider trust in a wider sense too it may even be worse than “double” because I do not have the same amount of trust for the package I am ultimately installing and the script I am using to install it. Edit: it’s actually 3 things you need to trust I didn’t include curl itself which just released a security audit that found a number of vulnerabilities here https://daniel.haxx.se/blog/2022/12/21/the-2022-curl-security-audit/ https://daniel.haxx.se/blog/2022/12/21/the-2022-curl-securit... …security is often harder than it looks.
    - kibwen 4y ago
      > now you have to trust two things rather than one No, you're still trusting one thing: the host itself. You're downloading both the script and the binary from the host. Both could be backdoored, and of the two, the binary is far easier to hide a backdoor in. As for not trusting curl, you still need to fetch the resource somehow, so you're going to be trusting some tool to do it for you. That's not relevant to increasing the attack surface.
      - mhoad 4y ago
        I’m not actually in the Rust ecosystem at all and only just discovered the domain belongs to the official Rust project. That clearly changes the trust calculation in this scenario. I had assumed it was some 3rd party project which would have put it in a different category of problems entirely. But the entire conversation is kind of pointless then. “There is a secret backdoor in the official Rust binary” is not a useful part of any reasonable threat model.
      - Someone 4y ago
- dmitriid 4y ago
  This is because people are tired of figuring out seventeen (hundred) different package managers that may or may not work and that may or may not accept your package into their repo?
- mrtngslr 4y ago
  To be honest, the course suggests using apt since that's an easy security-approved way to install things on our computers (see https://en.wikipedia.org/wiki/GLinux https://en.wikipedia.org/wiki/GLinux). I'll be happy to update it to suggest using rustup like "normal". Could you make a PR for that?
  - mrtngslr 4y ago
    Actually, there is already an issue for this: https://github.com/google/comprehensive-rust/issues/19 https://github.com/google/comprehensive-rust/issues/19 and I hope someone will fix it soon :-)
  - ohbtvz 4y ago
    Are you sure you're replying to the correct comment?
    - mrtngslr 4y ago
      Sorry, you're right :-) I meant to comment further up where people asked if we could reference rustup.rs in the installation instructions.
- Arnavion 4y ago
  https://news.ycombinator.com/item?id=33380755 https://news.ycombinator.com/item?id=33380755
zozbot234 4y ago
Apt gives you the version of Rust that was packaged for your distro, so you're not keeping up with the latest releases. It's typically configured to reuse the system install of LLVM, missing some Rust-specific patches that are in the process of flowing upstream. And it references distro-packaged crates by default, meaning that again you're not getting the latest published versions.
mrtngslr 4y ago
Hi, I wrote the course :-) Yes, this is a real thing — Android has had support for Rust in the Android Platform for a few years now. Most recently, we shipped support for DNS-over-HTTP/3: https://security.googleblog.com/2022/07/dns-over-http3-in-android.html https://security.googleblog.com/2022/07/dns-over-http3-in-an... We put out the course to make it easy for even more people to onboard with Rust.
- lillecarl 4y ago
  Rust does not guarantee that there are no memory leaks, you can have things reference eachother and therefore never count to 0. This is why weak pointers exist in rust.
  - pkolaczk 4y ago
    It does not guarantee, but it is actually quite hard to cause a memory leak by accident, because at the same time Rust makes creating cycles hard.
    - mrtngslr 4y ago
      I actually haven't tried this... do you know off the top of your head what it takes to make a cycle with Rc? It should not be possible with normal borrows (and safe Rust) since they're statically checked to be acyclic.
      - britneybitch 4y ago
        You could store a `RefCell<Option<T>>` in an `Rc` and set it to `Some(rc)` after creation. Or you could use the recently-stabilized `new_cyclic` method: https://doc.rust-lang.org/std/rc/struct.Rc.html#method.new_cyclic https://doc.rust-lang.org/std/rc/struct.Rc.html#method.new_c...
      - bitexploder 4y ago
        And when using C libraries / FFI, there are a lot of tricky things going in, it is much easier to leak in unsafe land.
izacus 4y ago
> Is this “just” a 20% project or is this more significant (like Android one day supporting Rust to develop apps)? It's very unlikely you'll ever see Android supporting apps written in 100% Rust (just like it doesn't support apps written in 100% C++/C) - the APIs and UI toolkit are exposed and written in Java and you'll need to bridge either way. Supporting Rust as a native code language to augment existing support for C/C++ via NDK is much more likely.
teaearlgraycold 4y ago
I sit next to a guy in Mountain View that works full time just on teaching people Rust and integrating Rust into Android. There’s a whole team dedicated to getting Android developers writing Rust. The difference in installation procedure is probably a security measure. Piping curl to bash is a bad move and it’s the Android security department that’s pushing Rust in Android. Plus, internally, Google has well maintained aptitude repositories with projects built from HEAD. It’s nice installing something like lldb from the command line and the internal Python interpreter is the latest version. And you know all of your coworkers are running that version, too.

by 1f60c 4y ago

schipplock 4y ago

They mention rustup on the 3rd slide.

rob74 4y ago

They're using Rust in the android system: https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html https://security.googleblog.com/2022/12/memory-safe-language...

est31 4y ago

> Is this “just” a 20% project or is this more significant (like Android one day supporting Rust to develop apps)? Android already uses Rust internally, in fact for new code it's a major language. They have made this guide to teach Rust to their engineers working on Android, according to this post on reddit: https://old.reddit.com/r/rust/comments/zrs1of/new_rust_course_by_android_comprehensive_rust/j14dgu3/ https://old.reddit.com/r/rust/comments/zrs1of/new_rust_cours...

ohbtvz 4y ago

I'm tired of installation instructions that consist of "curl | sh". Especially since this one just tries to detect the platform and downloads the correct installer for me. I know what platform I'm running, and I don't want to pipe the internet to my shell. In the end this is unpacking a tarball in ~/.rustup, I don't need the risk of running some bespoke script for that.

est31 4y ago
On some distros you can install rustup directly, e.g. NixOS or Arch. For Ubuntu, it's sadly not in the default repositories, but there is a snap for rustup uploaded by the rustup maintainer. https://pkgs.org/search/?q=rustup https://pkgs.org/search/?q=rustup https://snapcraft.io/rustup https://snapcraft.io/rustup
kibwen 4y ago
Since the ultimate objective is to run a binary blob that you just downloaded off of the internet, piping a script to your shell over HTTPS adds no additional attack surface.
- mhoad 4y ago
  I get what you are trying to say here but I could also make the argument that you actually doubled it because now you have to trust two things rather than one. Depending on how you want to consider trust in a wider sense too it may even be worse than “double” because I do not have the same amount of trust for the package I am ultimately installing and the script I am using to install it. Edit: it’s actually 3 things you need to trust I didn’t include curl itself which just released a security audit that found a number of vulnerabilities here https://daniel.haxx.se/blog/2022/12/21/the-2022-curl-security-audit/ https://daniel.haxx.se/blog/2022/12/21/the-2022-curl-securit... …security is often harder than it looks.
  - kibwen 4y ago
    > now you have to trust two things rather than one No, you're still trusting one thing: the host itself. You're downloading both the script and the binary from the host. Both could be backdoored, and of the two, the binary is far easier to hide a backdoor in. As for not trusting curl, you still need to fetch the resource somehow, so you're going to be trusting some tool to do it for you. That's not relevant to increasing the attack surface.
    - mhoad 4y ago
      I’m not actually in the Rust ecosystem at all and only just discovered the domain belongs to the official Rust project. That clearly changes the trust calculation in this scenario. I had assumed it was some 3rd party project which would have put it in a different category of problems entirely. But the entire conversation is kind of pointless then. “There is a secret backdoor in the official Rust binary” is not a useful part of any reasonable threat model.
    - Someone 4y ago
dmitriid 4y ago
This is because people are tired of figuring out seventeen (hundred) different package managers that may or may not work and that may or may not accept your package into their repo?
mrtngslr 4y ago
To be honest, the course suggests using apt since that's an easy security-approved way to install things on our computers (see https://en.wikipedia.org/wiki/GLinux https://en.wikipedia.org/wiki/GLinux). I'll be happy to update it to suggest using rustup like "normal". Could you make a PR for that?
- mrtngslr 4y ago
  Actually, there is already an issue for this: https://github.com/google/comprehensive-rust/issues/19 https://github.com/google/comprehensive-rust/issues/19 and I hope someone will fix it soon :-)
- ohbtvz 4y ago
  Are you sure you're replying to the correct comment?
  - mrtngslr 4y ago
    Sorry, you're right :-) I meant to comment further up where people asked if we could reference rustup.rs in the installation instructions.
Arnavion 4y ago
https://news.ycombinator.com/item?id=33380755 https://news.ycombinator.com/item?id=33380755

zozbot234 4y ago

Apt gives you the version of Rust that was packaged for your distro, so you're not keeping up with the latest releases. It's typically configured to reuse the system install of LLVM, missing some Rust-specific patches that are in the process of flowing upstream. And it references distro-packaged crates by default, meaning that again you're not getting the latest published versions.

mrtngslr 4y ago

Hi, I wrote the course :-) Yes, this is a real thing — Android has had support for Rust in the Android Platform for a few years now. Most recently, we shipped support for DNS-over-HTTP/3: https://security.googleblog.com/2022/07/dns-over-http3-in-android.html https://security.googleblog.com/2022/07/dns-over-http3-in-an... We put out the course to make it easy for even more people to onboard with Rust.

lillecarl 4y ago
Rust does not guarantee that there are no memory leaks, you can have things reference eachother and therefore never count to 0. This is why weak pointers exist in rust.
- pkolaczk 4y ago
  It does not guarantee, but it is actually quite hard to cause a memory leak by accident, because at the same time Rust makes creating cycles hard.
  - mrtngslr 4y ago
    I actually haven't tried this... do you know off the top of your head what it takes to make a cycle with Rc? It should not be possible with normal borrows (and safe Rust) since they're statically checked to be acyclic.
    - britneybitch 4y ago
      You could store a `RefCell<Option<T>>` in an `Rc` and set it to `Some(rc)` after creation. Or you could use the recently-stabilized `new_cyclic` method: https://doc.rust-lang.org/std/rc/struct.Rc.html#method.new_cyclic https://doc.rust-lang.org/std/rc/struct.Rc.html#method.new_c...
    - bitexploder 4y ago
      And when using C libraries / FFI, there are a lot of tricky things going in, it is much easier to leak in unsafe land.

izacus 4y ago

> Is this “just” a 20% project or is this more significant (like Android one day supporting Rust to develop apps)? It's very unlikely you'll ever see Android supporting apps written in 100% Rust (just like it doesn't support apps written in 100% C++/C) - the APIs and UI toolkit are exposed and written in Java and you'll need to bridge either way. Supporting Rust as a native code language to augment existing support for C/C++ via NDK is much more likely.

teaearlgraycold 4y ago

I sit next to a guy in Mountain View that works full time just on teaching people Rust and integrating Rust into Android. There’s a whole team dedicated to getting Android developers writing Rust. The difference in installation procedure is probably a security measure. Piping curl to bash is a bad move and it’s the Android security department that’s pushing Rust in Android. Plus, internally, Google has well maintained aptitude repositories with projects built from HEAD. It’s nice installing something like lldb from the command line and the internal Python interpreter is the latest version. And you know all of your coworkers are running that version, too.