16 ms·

Microsoft exec says Windows 11 kernel will soon be booting with Rust inside

407 points by itvision 3y ago

taspeotis 3y ago
Microsoft is busy rewriting core Windows library code in memory-safe Rust (theregister.com) 147 points by mikece 9 hours ago | flag | hide | past | favorite | 106 comments https://news.ycombinator.com/item?id=35735444 https://news.ycombinator.com/item?id=35735444
- mustache_kimono 3y ago
  > BlueHat IL 2023: Microsoft rewriting core Windows libraries in Rust (youtube.com) 89 points by mustache_kimono 23 hours ago | past | 45 comments The primary source material is this talk: https://www.youtube.com/watch?v=8T6ClX-y2AE https://www.youtube.com/watch?v=8T6ClX-y2AE
  - thrownaway561 3y ago
    Exact place where they talk about Memory Safety https://youtu.be/8T6ClX-y2AE?t=2616 https://youtu.be/8T6ClX-y2AE?t=2616
w-m 3y ago
One of the slides lists: > Has driven changes in upstream Rust: more try_ methods for Vec that don't panic in OOM: https://github.com/rust-lang/rust/pull/95051 https://github.com/rust-lang/rust/pull/95051 I was curious to have a look at that PR, but it seems it was closed after a long discussion (mainly because it would add ~30% more methods to Vec?). So which changes landing in upstream Rust is the bullet point referring to? Was the Keyword Generics Initiative born out of this?
- bootsmann 3y ago
  They actually split these changes into their own crate I think: https://github.com/microsoft/rust_fallible_vec https://github.com/microsoft/rust_fallible_vec
- secondcoming 3y ago
  Panicking on OOM was always a questionable design decision. It doesn't always mean that your app has no memory, it just means that your chosen allocator has no free memory. That's not always an unrecoverable situation.
  - legulere 3y ago
    It really depends on what you are doing. If you’re writing an application running on an operating system you don’t need out of memory handling, it will even make programming harder.
    - roblabla 3y ago
      That's not necessarily the case though. It may be worth it for, say, a document viewer to catch the OOM condition and show a user-friendly error instead of dying. Of course, linux with overcommit memory can't do this. But on Windows, that's totally a thing that can happen.
      - godshatter 3y ago
        I was curious so I did a Brave search to find out if that behavior can be changed. You can supposedly (I haven't tried it) echo 2 into /proc/sys/vm/overcommit_memory and the kernel will refuse to commit more memory for a process than the available swap space and a fraction of available memory (which is also configurable). See https://www.win.tue.nl/~aeb/linux/lk/lk-9.html#ss9.6 https://www.win.tue.nl/~aeb/linux/lk/lk-9.html#ss9.6 for more details. I usually write my programs to only grab a little more memory than is actually needed so I might play around with this at home. I wonder if this has lead to a culture of grabbing more memory than is actually needed since mallocs only fail at large values if everything is set the traditional way. Defaulting to overcommit seems risky. I'd much rather the system tell me no more memory is available than just having something segfault. I could always wait a bit and try again or something or at the very least shut down the program in a controlled manner.
        temac 3y ago
- moremetadata 3y ago
  [dead]
- ChrisSD 3y ago
  > (mainly because it would add ~30% more methods to Vec?) Sort of. Rather than bolting on fallible methods adhoc to an existing type, it was felt it would be better to take a step back and actually design this properly. This includes third party crates experimenting with different options. Maybe we should have a FallibleVec type? Maybe common vec-like methods could be abstracted out in to a `RawVec` type? Maybe both? Maybe the (unstable) `Allocator` API could be adapted to better suite all these cases? Whatever the case it's not great to be adding on a ton of methods in the heat of the moment.
nindalf 3y ago
Link to the talk - https://www.youtube.com/watch?t=2611&v=8T6ClX-y2AE https://www.youtube.com/watch?t=2611&v=8T6ClX-y2AE (timestamped to the part about Rust) The speaker covers a bunch of areas and the final part of the talk (around 10 minutes) is about Microsoft introducing Rust in some self-contained areas in Windows. Some highlights: - Their focus is on "killing bug classes". More context in this post by Microsoft Research from 2019 - A proactive approach to more secure code. - They want to do this with memory safe languages, CPU architectural changes and safer language subsets. This talk focussed on memory safe languages, specifically Rust. - First area they've introduced Rust in - a cross platform rewrite of a font parser called DWriteCore. The team reported that parsing was "incredibly easy". Font shaping performance increased by 5-15% compared to the C++ version. - It took about 2 devs working for half a year to complete this. The speaker says this is pretty good value for an area that is notorious for security bugs. - Second area is the REGION data type in Win32k GDI. Currently in consumer Windows, disabled by feature flag. Will be enabled in insider builds soon. Performance has been good, some small wins for the Rust version. - There is now a Windows SysCall implemented in completed safe Rust. TLDR - Rust is inside the Windows Kernel, will be enabled widely soon.
- bonzini 3y ago
  Note that this is high-level GUI stuff and GDI is only in the kernel due to old decisions made in the early 1990s (Windows NT 3.5).
- AntonCTO 3y ago
  > Font shaping performance increased by 5-15% compared to the C++ version. Personally, I wouldn't link it directly to rust, but to rewriting. When you develop something, you usually can't account for all future changes that affect performance, design, LOC, robustness, and so on. But with rewrite, you take them all into account. So there is a big chance that rewrite will be superior in many areas. It will probably have the same effect as if they had rewritten it in C++ again.
  - bobnamob 3y ago
    Isn’t this exactly contrary to what second system syndrome would have us believe?
RcouF1uZ4gsC 3y ago
Microsoft has been interested in using memory safe languages in the kernel for some time now. An example is the Midori project led by Joe Duffy back in 2009 which explored the idea with a C# derivative. Rust is a game changer in that it is built from the ground up to offer memory safety without garbage collection and still aims for zero overhead abstractions. It would be ironic, after their notorious security issues of the early 2000’s, if due to efforts like this, Microsoft Windows ends up being the most secure general operating system.
- hardware2win 3y ago
  Project Midori was really good read, a lot of good stuff came from it https://joeduffyblog.com/2015/11/03/blogging-about-midori/ https://joeduffyblog.com/2015/11/03/blogging-about-midori/
- ztnktl 3y ago
  >Microsoft Windows ends up being the most secure general operating system It already is. What, exactly, is better than Windows at security features on desktop computers? Linux? There is nothing in there that comes even close to the defensive features of windows, like HVCI, a subsystem that checks for driver signatures and the likes isolated by virtualization mechanisms, which completely prevents tempering with the kernel. Linux's support for secure boot only exists to make it convenient to dual boot with windows, it doesn't do enough to prevent kernel level rootkits, it's a total placebo and it's even worse if you use a distro that doesn't have signed kernels, like Archlinux. If you're self signing on the same computer, how exactly are you stopping malware? Since Vista, the OS also gained some serious resilience against crashes that I have never seen on other operating systems. For example, it is possible for your desktop session to survive a GPU driver crash. On linux this is a guaranteed freeze or kernel panic. This is, fortunately, a rare event, but the last times I've seen my computer freeze on linux, it was always because of the graphic stack. openBSD's slogan for having few remotely exploitable exploits out of the box doesn't mention that it's because it has literally no features enabled out of the box. macOS and iOS are the systems with the greatest amount of privilege escalation fails by far. In fact, what do people think jailbreaks are? Some of which are truly frightening when you think about what could have been. Multiple jailbreaks were made that could be run just by browsing a webpage on safari. This means they punched through the browser, punched through privilege escalation and had the potential to install a rootkit on your phone. Just by visiting. A. Webpage. How many times such a thing has happened on Windows in the recent years? visiting a webpage installed a rootkit on your computer?
techwiz137 3y ago
I know this may seem an odd question, but what happens in a post rust world, when you NEED to exploit a system? Such as say in 20 years when you want to be able to run custom code in a then old console.
- phoe-krk 3y ago
  Not all exploits are possible because of software bugs: see e.g. https://free60.org/Hacks/Reset_Glitch_Hack/ https://free60.org/Hacks/Reset_Glitch_Hack/
  - Gigachad 3y ago
    Yeah these days a lot of hacking has been voltage glitches and other hardware hacking. Rust ensures no kind of safety when the CPU is not operating within it's normal rules.
- 0zemp2c 3y ago
  Rust-ified Windows will still have the fundamental exploitable flaw of Windows - the ability to download binaries from anywhere and give them Admin privs
  - leftyspook 3y ago
    I think this question was posed more at locked-down platforms like consoles.
    - techwiz137 3y ago
      Not just. But the ability to run custom code. Such as an Android phone in the future, which is running some rust-hardened kernel and has a locked down bootloader. All of this will become e-waste without the ability to run unsigned code. And not only, by allowing custom code, which some do not allow, the usefulness or even purpose of the device can be extended or altered. I dont' want to throw away a perfectly usable device just because the company made it obsolete.
  - 3y ago
lbriner 3y ago
My concern is that Windows is already a massive dumpster fire of random bits and bobs. They haven't completed the migrations from the very earliest versions of Windows, they just increase the complexity at all points. The same is true of most of their major desktop apps including Visual Studio, which runs something like 30 processes just to have the main window running including a hotchpotch of EdgeView and Node js bits. All this becomes is the xkcd trope of "this next migration will really fix our problems". Unless they can genuinely replace more than 1 sub system in one go, they just increase complexity.
- intalentive 3y ago
  It's ok, Moore's Law will save us.
jimnotgym 3y ago
HN (heart) Rust. Therefore HN (heart) Windows? That will be novel....
gigatexal 3y ago
haha i wish Microsoft would just rebase Windows on Linux: extract the Windows "experience"(sic) into a UI/Desktop Environment for Linux and then bless some LTS of Linux as the underlying system and call it a day. Of course they would never, ever do that, but I can hope however hopeless that is.
- petesergeant 3y ago
  Is there a specific benefit you think that would bring?
  - whstl 3y ago
    Not the person you asked, but: this would certainly bring more benefits to Linux and its users/community than to Microsoft...
  - gigatexal 3y ago
    well for one it'd be free. You'd get the windows experience without having to pay a license. It'd be based on a userland and kernel that is open source. And the UI would be hackable (if it were opened up). Those 3 reasons are huge imo
    - pjmlp 3y ago
      There you go, have fun. https://reactos.org/ https://reactos.org/
      - gigatexal 3y ago
        Nice joke
- pjmlp 3y ago
  Why bother when we can enjoy an OpenVMS descendent instead.
- delta_p_delta_x 3y ago
  Why do people on Hacker News dislike the Windows kernel so much, without knowing a gram about the innards of Windows? All you lot see is the Windows shell, which is fairly trivial to replace (ergo why it has changed so often in the past 30 years since NT 3.1). Windows NT is a remarkably modular kernel architecture, with design decisions far ahead of its time. Things like (acronym overload here) COM, (A)LPC, UMDF, Windows subsystems (for Linux and Android), and an absolutely immense media and utilities ecosystem: Direct3D, DirectWrite, WASAPI, etc. Why not hope Microsoft open-sources the entire Windows stack including the NT kernel, NTFS drivers, and the Windows API, rather than hope it 'uses Linux'? > Windows "experience"(sic) into a UI/Desktop Environment for Linux And for the record, this more-or-less already exists: it's called KDE Plasma Desktop 5.
IceHegel 3y ago
Are they porting their acclaimed tabloid news service or does that stay in cpp?
- Narishma 3y ago
  The tabloid news service runs in the kernel?
  - pdimitar 3y ago
    Since people hate it so much and Microsoft is treating their OS like a website to be monetized then it wouldn't surprise me if the tabloid service gets embedded in the kernel, so as to prevent people from disabling or removing it.
    - intelVISA 3y ago
      In the not-too-distant future Intel bootguard et al. will enforce 'secure booting' of the tabloid microkernel. /s ...unless..?
      - pdimitar 3y ago
        That's not sarcasm, that's the upcoming cyberpunk future. One day people will smoke on the streets and will comment "Wonder what happened to the tech wizards, we really could use some of them right now".
        pixl97 3y ago
        Na, they will be too busy trapped in AI created unskippable commercials taking over their audio and visual cortex on their neural linking device to remember there was anything better in the past.
        pdimitar 3y ago
        Absolutely. But things always swing around. Even in today's age (during COVID) some small % of the populace actually moved out from the big cities and into rural -- or just smaller city -- communities. I have hope. Sadly the positive societal changes move with the average speed of a glacier.
lousken 3y ago
Why wasting time on this? Why not just spend the dev time on showing more ads?
- wongarsu 3y ago
  The teams working on the kernel and the team working on userspace have always had different priorities and quality of work, to the point that it's not obvious that they are made by the same company. I find lots of things I don't like about Windows userspace (with a few nuggets of greatness in between), but the Windows Kernel is pretty great.
- jabroni_salad 3y ago
  Excuse me, those are not ads, they are special messages from our featured partners.
- zaphar 3y ago
  Your question reads as slightly tongue in cheek. But you can learn something by asking and answering it in this case. When should you think about rewriting something? 1. When it's a common recurring source of bugs/problems/pain. 2. When it's no longer fit for purpose. Often either because the purpose has changed in some way or because the purpose was misunderstood when it was created. In this case at least some of the rewrites were prompted by subsystems being a common source of memory safety bugs continually popping up. Rewriting with technologies and techniques that eliminate some classes of memory safety bugs immediately and in the future is a pretty large payoff for a kernel.
- michaelcampbell 3y ago
  They're busy writing the code to put the ads in the start menu and all the system settings screens.
- 0dayz 3y ago
  Maybe they are writing an ad kernel module in rust. To you know catch those pesky ad cheaters.
dehrmann 3y ago
Nice try, Microsoft. You'll need to do more than just use more Rust to get me to downgrade to Windows 11.
diego_moita 3y ago
This is "surprise" because Microsoft announced it? It has been possible to use Rust to write device drivers that run on Windows kernel space for years, already. The Windows-rs crate (Microsoft's crate wrapping the Windows API) already has the WDK for a while (i.e.: the special sdk to interact with the kernel). I welcome the news and agree it is important and meaningful but it is the kind of thing that was easy to see coming.
- seritools 3y ago
  > already has the WDK for a while I would interpret "for a while" as more than ~7 weeks. Version 0.46 added initial WDK support: https://github.com/microsoft/windows-rs/releases/tag/0.46.0 https://github.com/microsoft/windows-rs/releases/tag/0.46.0
- haswell 3y ago
  Who is saying this is a surprise? There are plenty of things in this industry that are hardly surprising but still newsworthy. The real bummer is that this might eventually be a reason to switch to Win 11, which is something I’ve been trying to avoid for as long as possible.
annoyingnoob 3y ago
Windows kernel already had rust and now has Rust.
stcroixx 3y ago
[flagged]
shortrounddev 3y ago
I like writing C++ code, and I like using SAL annotations to try to improve safety. I try to remember to be const correct as best as I can. Is Rust something I would enjoy? It's hard to discern the signal from the noise on this lang
- _flux 3y ago
  I think you will appreciate that moving objects actually invalidates the original bindings and the compiler checks for this quite effectively. Though there is some learning curve..
  - shortrounddev 3y ago
    So the equivalent of std::move will also make sure to "null" the original object at the same time?
    - VWWHFSfQ 3y ago
      It's not just a matter of "null"ing the reference. The program just won't compile at all if you try to use that reference again
      - dataflow 3y ago
        Surely there's more to it than this? Otherwise you can just set up bugprone-use-after-move checks in C++ and call it a day.
        dmkolobov 3y ago
        The difference is that your C++ checks are executed at runtime. Rust's borrow-checker rules ensure this occurs at compile-time, before you ever run any code.
        dataflow 3y ago
        The check I mentioned is a compile time check. I'm not referring to ASAN.
chrishannah 3y ago
I just hope the Windows logo is bigger than the Rust logo...
bigmattystyles 3y ago
Dumb question, but isn’t Rust an awful name marketing wise? How did the language’s founders settle on it? Hopefully there’s a more interesting history than rust is a thin layer atop bare metal.
- deleted 3y ago
  [deleted]
- pchangr 3y ago
  I’ll copy a TLDR verbatim from stack overflow: „TL;DR: Rust is named after a fungus that is robust, distributed, and parallel. And, Graydon is a biology nerd.“ https://www.reddit.com/r/rust/comments/27jvdt/internet_archaeology_the_definitive_endall_source/ https://www.reddit.com/r/rust/comments/27jvdt/internet_archa...
- avazhi 3y ago
  I like the name, personally.
- j0057 3y ago
  Good question! Per Wikipedia: "Hoare would later state that Rust was named after the rust fungus, with reference to the fungus's hardiness." See https://en.wikipedia.org/wiki/Rust_%28programming_language%29#Evolution_(2012%E2%80%932019) https://en.wikipedia.org/wiki/Rust_%28programming_language%2....
- otoburb 3y ago
  Peering into the mists of time in ages past we hear rumours[1] of an ancient sage naming their new language after the hardy fungi Pucciniales[2]. [1] https://www.reddit.com/r/rust/comments/27jvdt/internet_archaeology_the_definitive_endall_source/ https://www.reddit.com/r/rust/comments/27jvdt/internet_archa... [2] https://en.m.wikipedia.org/wiki/Rust_(fungus) https://en.m.wikipedia.org/wiki/Rust_(fungus)
- runjake 3y ago
  From the first Google result: "Graydon Hoare named the language after the rust fungus because it is robust, distributed, and parallel. He also liked the play on the words from words such as robust, trust, frustrating, rustic, and thrust." https://www.reddit.com/r/rust/comments/27jvdt/internet_archaeology_the_definitive_endall_source/ https://www.reddit.com/r/rust/comments/27jvdt/internet_archa...
_chu1 3y ago
Any good reason why or are they using Rust for brownie points
- dcsommer 3y ago
  https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se... https://www.zdnet.com/article/chrome-70-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/chrome-70-of-all-security-bugs... https://alexgaynor.net/2019/aug/12/introduction-to-memory-unsafety-for-vps-of-engineering/#how-common-are-vulnerabilities-due-to-memory-unsafety https://alexgaynor.net/2019/aug/12/introduction-to-memory-un...
  - _chu1 3y ago
    Is the performance on par?
    - howinteresting 3y ago
      Generally, and sometimes better than C++.
vrglvrglvrgl 3y ago
[dead]
seydor 3y ago
Now can we please get some basic customizations back, like the taskbar settings and the horrible rounded corners. Enough with apeing Apple
- bitwarrior 3y ago
  Rounded corners? This is the hill you are choosing to die on? How are these trivialities impacting your day to day use of Windows? I'd say I'm quite the opposite. I'd much rather hear Microsoft working on core technical improvements rather than adjusting the goddamn roundedness of their UI.
  - seydor 3y ago
    The missing UI features and anti-ergonomic styling is affecting my workday more than tiny improvements in performance or memory safety. And unfortunately my new computer does not allow rollback
  - theandrewbailey 3y ago
    Microsoft keeps messing with the UI in obviously deleterious ways. If they didn't rewrite the entire interface in 11, no one would be complaining about 11's rounded corners. The very fact that they decided to add rounded corners has likely already distracted from kernel work. Do you remember when Windows 10 was the last version of Windows? I wish we could go back. https://www.theverge.com/2015/5/7/8568473/windows-10-last-version-of-windows https://www.theverge.com/2015/5/7/8568473/windows-10-last-ve...
    - babypuncher 3y ago
      > The very fact that they decided to add rounded corners has likely already distracted from kernel work. The Windows team is so huge that I wouldn't be surprised if the people writing the shell and the people writing the kernel barely know eachother's names.
  - lelanthran 3y ago
    Yeah, like more telemetry!
5350-uiop-1130 3y ago
Gives a new meaning to the old idea of "Windows rot" not that I've experienced that on Win10, which I found to be great.
standardly 3y ago
Best practice has always been to avoid kernel moisture, now they're actually shipping rusty kernels. shame edit: wrong kind of rust
jug 3y ago
Since Microsoft developed the curious WinRT/Rust language projection, I've wondered if this would happen. I mean, sure, it's useful anyway but still quite a niche product and was an oddly sudden dive into Rust from Microsoft at the time. https://github.com/microsoft/windows-rs https://github.com/microsoft/windows-rs
- pjmlp 3y ago
  Who knows how it will evolve, those are the same folks responsible for deprecating C++/CX and bringing back the WinRT development experience to COM/C++ like in 2000, before .NET came to be. Eventually they got tired of C++/WinRT, left it half-done (see CppCon 2016 talk about future roadmap plans), and started Rust/winRT.
fnordpiglet 3y ago
Great. They’ll add bing ads into std.
rozal 3y ago
Good decision, I love this game
Tempest1981 3y ago
One thing caught my eye: 96 KLOC of C++ is now 152 KLOC of Rust. What causes the increase, and is that 1.5x ratio typical?

407 points by itvision 3y ago

Microsoft is busy rewriting core Windows library code in memory-safe Rust (theregister.com) 147 points by mikece 9 hours ago | flag | hide | past | favorite | 106 comments https://news.ycombinator.com/item?id=35735444 https://news.ycombinator.com/item?id=35735444

mustache_kimono 3y ago
> BlueHat IL 2023: Microsoft rewriting core Windows libraries in Rust (youtube.com) 89 points by mustache_kimono 23 hours ago | past | 45 comments The primary source material is this talk: https://www.youtube.com/watch?v=8T6ClX-y2AE https://www.youtube.com/watch?v=8T6ClX-y2AE
- thrownaway561 3y ago
  Exact place where they talk about Memory Safety https://youtu.be/8T6ClX-y2AE?t=2616 https://youtu.be/8T6ClX-y2AE?t=2616

w-m 3y ago

One of the slides lists: > Has driven changes in upstream Rust: more try_ methods for Vec that don't panic in OOM: https://github.com/rust-lang/rust/pull/95051 https://github.com/rust-lang/rust/pull/95051 I was curious to have a look at that PR, but it seems it was closed after a long discussion (mainly because it would add ~30% more methods to Vec?). So which changes landing in upstream Rust is the bullet point referring to? Was the Keyword Generics Initiative born out of this?

bootsmann 3y ago
They actually split these changes into their own crate I think: https://github.com/microsoft/rust_fallible_vec https://github.com/microsoft/rust_fallible_vec
secondcoming 3y ago
Panicking on OOM was always a questionable design decision. It doesn't always mean that your app has no memory, it just means that your chosen allocator has no free memory. That's not always an unrecoverable situation.
- legulere 3y ago
  It really depends on what you are doing. If you’re writing an application running on an operating system you don’t need out of memory handling, it will even make programming harder.
  - roblabla 3y ago
    That's not necessarily the case though. It may be worth it for, say, a document viewer to catch the OOM condition and show a user-friendly error instead of dying. Of course, linux with overcommit memory can't do this. But on Windows, that's totally a thing that can happen.
    - godshatter 3y ago
      I was curious so I did a Brave search to find out if that behavior can be changed. You can supposedly (I haven't tried it) echo 2 into /proc/sys/vm/overcommit_memory and the kernel will refuse to commit more memory for a process than the available swap space and a fraction of available memory (which is also configurable). See https://www.win.tue.nl/~aeb/linux/lk/lk-9.html#ss9.6 https://www.win.tue.nl/~aeb/linux/lk/lk-9.html#ss9.6 for more details. I usually write my programs to only grab a little more memory than is actually needed so I might play around with this at home. I wonder if this has lead to a culture of grabbing more memory than is actually needed since mallocs only fail at large values if everything is set the traditional way. Defaulting to overcommit seems risky. I'd much rather the system tell me no more memory is available than just having something segfault. I could always wait a bit and try again or something or at the very least shut down the program in a controlled manner.
      - temac 3y ago
moremetadata 3y ago
[dead]
ChrisSD 3y ago
> (mainly because it would add ~30% more methods to Vec?) Sort of. Rather than bolting on fallible methods adhoc to an existing type, it was felt it would be better to take a step back and actually design this properly. This includes third party crates experimenting with different options. Maybe we should have a FallibleVec type? Maybe common vec-like methods could be abstracted out in to a `RawVec` type? Maybe both? Maybe the (unstable) `Allocator` API could be adapted to better suite all these cases? Whatever the case it's not great to be adding on a ton of methods in the heat of the moment.

nindalf 3y ago

Link to the talk - https://www.youtube.com/watch?t=2611&v=8T6ClX-y2AE https://www.youtube.com/watch?t=2611&v=8T6ClX-y2AE (timestamped to the part about Rust) The speaker covers a bunch of areas and the final part of the talk (around 10 minutes) is about Microsoft introducing Rust in some self-contained areas in Windows. Some highlights: - Their focus is on "killing bug classes". More context in this post by Microsoft Research from 2019 - A proactive approach to more secure code. - They want to do this with memory safe languages, CPU architectural changes and safer language subsets. This talk focussed on memory safe languages, specifically Rust. - First area they've introduced Rust in - a cross platform rewrite of a font parser called DWriteCore. The team reported that parsing was "incredibly easy". Font shaping performance increased by 5-15% compared to the C++ version. - It took about 2 devs working for half a year to complete this. The speaker says this is pretty good value for an area that is notorious for security bugs. - Second area is the REGION data type in Win32k GDI. Currently in consumer Windows, disabled by feature flag. Will be enabled in insider builds soon. Performance has been good, some small wins for the Rust version. - There is now a Windows SysCall implemented in completed safe Rust. TLDR - Rust is inside the Windows Kernel, will be enabled widely soon.

bonzini 3y ago
Note that this is high-level GUI stuff and GDI is only in the kernel due to old decisions made in the early 1990s (Windows NT 3.5).
AntonCTO 3y ago
> Font shaping performance increased by 5-15% compared to the C++ version. Personally, I wouldn't link it directly to rust, but to rewriting. When you develop something, you usually can't account for all future changes that affect performance, design, LOC, robustness, and so on. But with rewrite, you take them all into account. So there is a big chance that rewrite will be superior in many areas. It will probably have the same effect as if they had rewritten it in C++ again.
- bobnamob 3y ago
  Isn’t this exactly contrary to what second system syndrome would have us believe?

RcouF1uZ4gsC 3y ago

Microsoft has been interested in using memory safe languages in the kernel for some time now. An example is the Midori project led by Joe Duffy back in 2009 which explored the idea with a C# derivative. Rust is a game changer in that it is built from the ground up to offer memory safety without garbage collection and still aims for zero overhead abstractions. It would be ironic, after their notorious security issues of the early 2000’s, if due to efforts like this, Microsoft Windows ends up being the most secure general operating system.

hardware2win 3y ago
Project Midori was really good read, a lot of good stuff came from it https://joeduffyblog.com/2015/11/03/blogging-about-midori/ https://joeduffyblog.com/2015/11/03/blogging-about-midori/
ztnktl 3y ago
>Microsoft Windows ends up being the most secure general operating system It already is. What, exactly, is better than Windows at security features on desktop computers? Linux? There is nothing in there that comes even close to the defensive features of windows, like HVCI, a subsystem that checks for driver signatures and the likes isolated by virtualization mechanisms, which completely prevents tempering with the kernel. Linux's support for secure boot only exists to make it convenient to dual boot with windows, it doesn't do enough to prevent kernel level rootkits, it's a total placebo and it's even worse if you use a distro that doesn't have signed kernels, like Archlinux. If you're self signing on the same computer, how exactly are you stopping malware? Since Vista, the OS also gained some serious resilience against crashes that I have never seen on other operating systems. For example, it is possible for your desktop session to survive a GPU driver crash. On linux this is a guaranteed freeze or kernel panic. This is, fortunately, a rare event, but the last times I've seen my computer freeze on linux, it was always because of the graphic stack. openBSD's slogan for having few remotely exploitable exploits out of the box doesn't mention that it's because it has literally no features enabled out of the box. macOS and iOS are the systems with the greatest amount of privilege escalation fails by far. In fact, what do people think jailbreaks are? Some of which are truly frightening when you think about what could have been. Multiple jailbreaks were made that could be run just by browsing a webpage on safari. This means they punched through the browser, punched through privilege escalation and had the potential to install a rootkit on your phone. Just by visiting. A. Webpage. How many times such a thing has happened on Windows in the recent years? visiting a webpage installed a rootkit on your computer?

techwiz137 3y ago

I know this may seem an odd question, but what happens in a post rust world, when you NEED to exploit a system? Such as say in 20 years when you want to be able to run custom code in a then old console.

phoe-krk 3y ago
Not all exploits are possible because of software bugs: see e.g. https://free60.org/Hacks/Reset_Glitch_Hack/ https://free60.org/Hacks/Reset_Glitch_Hack/
- Gigachad 3y ago
  Yeah these days a lot of hacking has been voltage glitches and other hardware hacking. Rust ensures no kind of safety when the CPU is not operating within it's normal rules.
0zemp2c 3y ago
Rust-ified Windows will still have the fundamental exploitable flaw of Windows - the ability to download binaries from anywhere and give them Admin privs
- leftyspook 3y ago
  I think this question was posed more at locked-down platforms like consoles.
  - techwiz137 3y ago
    Not just. But the ability to run custom code. Such as an Android phone in the future, which is running some rust-hardened kernel and has a locked down bootloader. All of this will become e-waste without the ability to run unsigned code. And not only, by allowing custom code, which some do not allow, the usefulness or even purpose of the device can be extended or altered. I dont' want to throw away a perfectly usable device just because the company made it obsolete.
- 3y ago

lbriner 3y ago

My concern is that Windows is already a massive dumpster fire of random bits and bobs. They haven't completed the migrations from the very earliest versions of Windows, they just increase the complexity at all points. The same is true of most of their major desktop apps including Visual Studio, which runs something like 30 processes just to have the main window running including a hotchpotch of EdgeView and Node js bits. All this becomes is the xkcd trope of "this next migration will really fix our problems". Unless they can genuinely replace more than 1 sub system in one go, they just increase complexity.

intalentive 3y ago
It's ok, Moore's Law will save us.

jimnotgym 3y ago

HN (heart) Rust. Therefore HN (heart) Windows? That will be novel....

gigatexal 3y ago

haha i wish Microsoft would just rebase Windows on Linux: extract the Windows "experience"(sic) into a UI/Desktop Environment for Linux and then bless some LTS of Linux as the underlying system and call it a day. Of course they would never, ever do that, but I can hope however hopeless that is.

petesergeant 3y ago
Is there a specific benefit you think that would bring?
- whstl 3y ago
  Not the person you asked, but: this would certainly bring more benefits to Linux and its users/community than to Microsoft...
- gigatexal 3y ago
  well for one it'd be free. You'd get the windows experience without having to pay a license. It'd be based on a userland and kernel that is open source. And the UI would be hackable (if it were opened up). Those 3 reasons are huge imo
  - pjmlp 3y ago
    There you go, have fun. https://reactos.org/ https://reactos.org/
    - gigatexal 3y ago
      Nice joke
pjmlp 3y ago
Why bother when we can enjoy an OpenVMS descendent instead.
delta_p_delta_x 3y ago
Why do people on Hacker News dislike the Windows kernel so much, without knowing a gram about the innards of Windows? All you lot see is the Windows shell, which is fairly trivial to replace (ergo why it has changed so often in the past 30 years since NT 3.1). Windows NT is a remarkably modular kernel architecture, with design decisions far ahead of its time. Things like (acronym overload here) COM, (A)LPC, UMDF, Windows subsystems (for Linux and Android), and an absolutely immense media and utilities ecosystem: Direct3D, DirectWrite, WASAPI, etc. Why not hope Microsoft open-sources the entire Windows stack including the NT kernel, NTFS drivers, and the Windows API, rather than hope it 'uses Linux'? > Windows "experience"(sic) into a UI/Desktop Environment for Linux And for the record, this more-or-less already exists: it's called KDE Plasma Desktop 5.

IceHegel 3y ago

Are they porting their acclaimed tabloid news service or does that stay in cpp?

Narishma 3y ago
The tabloid news service runs in the kernel?
- pdimitar 3y ago
  Since people hate it so much and Microsoft is treating their OS like a website to be monetized then it wouldn't surprise me if the tabloid service gets embedded in the kernel, so as to prevent people from disabling or removing it.
  - intelVISA 3y ago
    In the not-too-distant future Intel bootguard et al. will enforce 'secure booting' of the tabloid microkernel. /s ...unless..?
    - pdimitar 3y ago
      That's not sarcasm, that's the upcoming cyberpunk future. One day people will smoke on the streets and will comment "Wonder what happened to the tech wizards, we really could use some of them right now".
      - pixl97 3y ago
        Na, they will be too busy trapped in AI created unskippable commercials taking over their audio and visual cortex on their neural linking device to remember there was anything better in the past.
        pdimitar 3y ago
        Absolutely. But things always swing around. Even in today's age (during COVID) some small % of the populace actually moved out from the big cities and into rural -- or just smaller city -- communities. I have hope. Sadly the positive societal changes move with the average speed of a glacier.

lousken 3y ago

Why wasting time on this? Why not just spend the dev time on showing more ads?

wongarsu 3y ago
The teams working on the kernel and the team working on userspace have always had different priorities and quality of work, to the point that it's not obvious that they are made by the same company. I find lots of things I don't like about Windows userspace (with a few nuggets of greatness in between), but the Windows Kernel is pretty great.
jabroni_salad 3y ago
Excuse me, those are not ads, they are special messages from our featured partners.
zaphar 3y ago
Your question reads as slightly tongue in cheek. But you can learn something by asking and answering it in this case. When should you think about rewriting something? 1. When it's a common recurring source of bugs/problems/pain. 2. When it's no longer fit for purpose. Often either because the purpose has changed in some way or because the purpose was misunderstood when it was created. In this case at least some of the rewrites were prompted by subsystems being a common source of memory safety bugs continually popping up. Rewriting with technologies and techniques that eliminate some classes of memory safety bugs immediately and in the future is a pretty large payoff for a kernel.
michaelcampbell 3y ago
They're busy writing the code to put the ads in the start menu and all the system settings screens.
0dayz 3y ago
Maybe they are writing an ad kernel module in rust. To you know catch those pesky ad cheaters.

dehrmann 3y ago

Nice try, Microsoft. You'll need to do more than just use more Rust to get me to downgrade to Windows 11.

diego_moita 3y ago

This is "surprise" because Microsoft announced it? It has been possible to use Rust to write device drivers that run on Windows kernel space for years, already. The Windows-rs crate (Microsoft's crate wrapping the Windows API) already has the WDK for a while (i.e.: the special sdk to interact with the kernel). I welcome the news and agree it is important and meaningful but it is the kind of thing that was easy to see coming.

seritools 3y ago
> already has the WDK for a while I would interpret "for a while" as more than ~7 weeks. Version 0.46 added initial WDK support: https://github.com/microsoft/windows-rs/releases/tag/0.46.0 https://github.com/microsoft/windows-rs/releases/tag/0.46.0
haswell 3y ago
Who is saying this is a surprise? There are plenty of things in this industry that are hardly surprising but still newsworthy. The real bummer is that this might eventually be a reason to switch to Win 11, which is something I’ve been trying to avoid for as long as possible.

annoyingnoob 3y ago

Windows kernel already had rust and now has Rust.

stcroixx 3y ago

[flagged]

shortrounddev 3y ago

I like writing C++ code, and I like using SAL annotations to try to improve safety. I try to remember to be const correct as best as I can. Is Rust something I would enjoy? It's hard to discern the signal from the noise on this lang

_flux 3y ago
I think you will appreciate that moving objects actually invalidates the original bindings and the compiler checks for this quite effectively. Though there is some learning curve..
- shortrounddev 3y ago
  So the equivalent of std::move will also make sure to "null" the original object at the same time?
  - VWWHFSfQ 3y ago
    It's not just a matter of "null"ing the reference. The program just won't compile at all if you try to use that reference again
    - dataflow 3y ago
      Surely there's more to it than this? Otherwise you can just set up bugprone-use-after-move checks in C++ and call it a day.
      - dmkolobov 3y ago
        The difference is that your C++ checks are executed at runtime. Rust's borrow-checker rules ensure this occurs at compile-time, before you ever run any code.
        dataflow 3y ago
        The check I mentioned is a compile time check. I'm not referring to ASAN.

chrishannah 3y ago

I just hope the Windows logo is bigger than the Rust logo...

bigmattystyles 3y ago

Dumb question, but isn’t Rust an awful name marketing wise? How did the language’s founders settle on it? Hopefully there’s a more interesting history than rust is a thin layer atop bare metal.

deleted 3y ago
[deleted]
pchangr 3y ago
I’ll copy a TLDR verbatim from stack overflow: „TL;DR: Rust is named after a fungus that is robust, distributed, and parallel. And, Graydon is a biology nerd.“ https://www.reddit.com/r/rust/comments/27jvdt/internet_archaeology_the_definitive_endall_source/ https://www.reddit.com/r/rust/comments/27jvdt/internet_archa...
avazhi 3y ago
I like the name, personally.
j0057 3y ago
Good question! Per Wikipedia: "Hoare would later state that Rust was named after the rust fungus, with reference to the fungus's hardiness." See https://en.wikipedia.org/wiki/Rust_%28programming_language%29#Evolution_(2012%E2%80%932019) https://en.wikipedia.org/wiki/Rust_%28programming_language%2....
otoburb 3y ago
Peering into the mists of time in ages past we hear rumours[1] of an ancient sage naming their new language after the hardy fungi Pucciniales[2]. [1] https://www.reddit.com/r/rust/comments/27jvdt/internet_archaeology_the_definitive_endall_source/ https://www.reddit.com/r/rust/comments/27jvdt/internet_archa... [2] https://en.m.wikipedia.org/wiki/Rust_(fungus) https://en.m.wikipedia.org/wiki/Rust_(fungus)
runjake 3y ago
From the first Google result: "Graydon Hoare named the language after the rust fungus because it is robust, distributed, and parallel. He also liked the play on the words from words such as robust, trust, frustrating, rustic, and thrust." https://www.reddit.com/r/rust/comments/27jvdt/internet_archaeology_the_definitive_endall_source/ https://www.reddit.com/r/rust/comments/27jvdt/internet_archa...

_chu1 3y ago

Any good reason why or are they using Rust for brownie points

dcsommer 3y ago
https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se... https://www.zdnet.com/article/chrome-70-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/chrome-70-of-all-security-bugs... https://alexgaynor.net/2019/aug/12/introduction-to-memory-unsafety-for-vps-of-engineering/#how-common-are-vulnerabilities-due-to-memory-unsafety https://alexgaynor.net/2019/aug/12/introduction-to-memory-un...
- _chu1 3y ago
  Is the performance on par?
  - howinteresting 3y ago
    Generally, and sometimes better than C++.

vrglvrglvrgl 3y ago

[dead]

seydor 3y ago

Now can we please get some basic customizations back, like the taskbar settings and the horrible rounded corners. Enough with apeing Apple

bitwarrior 3y ago
Rounded corners? This is the hill you are choosing to die on? How are these trivialities impacting your day to day use of Windows? I'd say I'm quite the opposite. I'd much rather hear Microsoft working on core technical improvements rather than adjusting the goddamn roundedness of their UI.
- seydor 3y ago
  The missing UI features and anti-ergonomic styling is affecting my workday more than tiny improvements in performance or memory safety. And unfortunately my new computer does not allow rollback
- theandrewbailey 3y ago
  Microsoft keeps messing with the UI in obviously deleterious ways. If they didn't rewrite the entire interface in 11, no one would be complaining about 11's rounded corners. The very fact that they decided to add rounded corners has likely already distracted from kernel work. Do you remember when Windows 10 was the last version of Windows? I wish we could go back. https://www.theverge.com/2015/5/7/8568473/windows-10-last-version-of-windows https://www.theverge.com/2015/5/7/8568473/windows-10-last-ve...
  - babypuncher 3y ago
    > The very fact that they decided to add rounded corners has likely already distracted from kernel work. The Windows team is so huge that I wouldn't be surprised if the people writing the shell and the people writing the kernel barely know eachother's names.
- lelanthran 3y ago
  Yeah, like more telemetry!

5350-uiop-1130 3y ago

Gives a new meaning to the old idea of "Windows rot" not that I've experienced that on Win10, which I found to be great.

standardly 3y ago

Best practice has always been to avoid kernel moisture, now they're actually shipping rusty kernels. shame edit: wrong kind of rust

jug 3y ago

Since Microsoft developed the curious WinRT/Rust language projection, I've wondered if this would happen. I mean, sure, it's useful anyway but still quite a niche product and was an oddly sudden dive into Rust from Microsoft at the time. https://github.com/microsoft/windows-rs https://github.com/microsoft/windows-rs

pjmlp 3y ago
Who knows how it will evolve, those are the same folks responsible for deprecating C++/CX and bringing back the WinRT development experience to COM/C++ like in 2000, before .NET came to be. Eventually they got tired of C++/WinRT, left it half-done (see CppCon 2016 talk about future roadmap plans), and started Rust/winRT.

fnordpiglet 3y ago

Great. They’ll add bing ads into std.

rozal 3y ago

Good decision, I love this game

Tempest1981 3y ago

One thing caught my eye: 96 KLOC of C++ is now 152 KLOC of Rust. What causes the increase, and is that 1.5x ratio typical?