5 ms·

Microsoft has been interested in using memory safe languages in the kernel for some time now. An example is the Midori project led by Joe Duffy back in 2009 whi

Microsoft has been interested in using memory safe languages in the kernel for some time now. An example is the Midori project led by Joe Duffy back in 2009 which explored the idea with a C# derivative. Rust is a game changer in that it is built from the ground up to offer memory safety without garbage collection and still aims for zero overhead abstractions. It would be ironic, after their notorious security issues of the early 2000’s, if due to efforts like this, Microsoft Windows ends up being the most secure general operating system.

hardware2win 4y ago
Project Midori was really good read, a lot of good stuff came from it https://joeduffyblog.com/2015/11/03/blogging-about-midori/ https://joeduffyblog.com/2015/11/03/blogging-about-midori/
ztnktl 4y ago
>Microsoft Windows ends up being the most secure general operating system It already is. What, exactly, is better than Windows at security features on desktop computers? Linux? There is nothing in there that comes even close to the defensive features of windows, like HVCI, a subsystem that checks for driver signatures and the likes isolated by virtualization mechanisms, which completely prevents tempering with the kernel. Linux's support for secure boot only exists to make it convenient to dual boot with windows, it doesn't do enough to prevent kernel level rootkits, it's a total placebo and it's even worse if you use a distro that doesn't have signed kernels, like Archlinux. If you're self signing on the same computer, how exactly are you stopping malware? Since Vista, the OS also gained some serious resilience against crashes that I have never seen on other operating systems. For example, it is possible for your desktop session to survive a GPU driver crash. On linux this is a guaranteed freeze or kernel panic. This is, fortunately, a rare event, but the last times I've seen my computer freeze on linux, it was always because of the graphic stack. openBSD's slogan for having few remotely exploitable exploits out of the box doesn't mention that it's because it has literally no features enabled out of the box. macOS and iOS are the systems with the greatest amount of privilege escalation fails by far. In fact, what do people think jailbreaks are? Some of which are truly frightening when you think about what could have been. Multiple jailbreaks were made that could be run just by browsing a webpage on safari. This means they punched through the browser, punched through privilege escalation and had the potential to install a rootkit on your phone. Just by visiting. A. Webpage. How many times such a thing has happened on Windows in the recent years? visiting a webpage installed a rootkit on your computer?
- deleted 4y ago
  [deleted]
- hardware2win 4y ago
  Anecdote: Ive tested a two or three years old Chrome version with JIT compiler vulnerability and guess what - on empty Linux vm it managed to escape chrome and execute code Meanwhile on Windows with Crowdstrike software installed Chrome just showed some error message about mem. access Im not sure who handled that attack - was it Windows or Crowdstrike, but eitherway Ive been impressed
  - selfmodruntime 4y ago
    I can pretty much guarantee that the Windows kernel stopped unallowed memory access from chrome to outside apps.
  - anthk 4y ago
    Under OpenBSD pledge and unveil would send that Chromium instance SIGABRT'ed. Your parent comment it's utterly wrong.
  - sekh60 4y ago
    With or without SELinux enabled?
    - hardware2win 4y ago
      Idk, that was fresh instal
- unnouinceput 4y ago
  Hold your horses there my good friend. Yes, Windows is better now than it was in the past but is still a shitty OS. None of them are actually. All of them continuously fail every single year at hackers gathering/hackatons/whatever public event, with multiple zero-day showing. Every single major OS out there is a joke from security point of view.
ape4 4y ago
Well Linux is using Rust in the kernel too.
- Narishma 4y ago
  Not yet.
  - pjmlp 4y ago
    The forked Android version is using it already for the last two years. Any Android 12 and later has a little bit of Rust taking care of the bluetooth communications driver.
    - Narishma 4y ago
      Is that only the case in Android?
      - pjmlp 4y ago
        That was only the begining, followed by Keystore2, the new Ultra-wideband (UWB) stack, DNS-over-HTTP3, Android’s Virtualization framework (AVF) on Android 13. https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html https://security.googleblog.com/2022/12/memory-safe-language... https://source.android.com/docs/setup/build/rust/building-rust-modules/overview https://source.android.com/docs/setup/build/rust/building-ru...
hgs3 4y ago
> Rust is a game changer in that it is built from the ground up to offer memory safety without garbage collection and still aims for zero overhead abstractions. Safe Rust cannot represent circular data structures which makes entire classes of algorithms and architectures unimplementable. You have to workaround these limitations by creating auxiliary structures for tracking references or use reference counting; neither are "zero overhead abstractions." Rust is only zero overhead if all you do is pass values up and down the call stack. Its false appeal says more about the simplistic types of applications folks are writing than anything else.
- jackmott42 4y ago
  Often the workaround to graph representations that safe Rust can't do with the usual pointer approach is faster. You keep the data in an array, which improves your cache hit rate. Even C++ programmers will often use the same workaround either for safety or performance reasons. As for overall performance in real programs, Rust seems to consistently do as well or better than C++ programs as the cases from Microsoft here show.
- dralley 4y ago
  > Safe Rust cannot represent circular data structures which makes entire classes of algorithms and architectures unimplementable In safe Rust. So just don't use safe Rust for those parts. Unsafe isn't evil, it's there for a reason. You should avoid it when possible and when there are no downsides, but sometimes there are, and that's ok.
- yazaddaruvala 4y ago
  The font parsing code was ported to 100% safe rust (other than the C FFI), and was 10-15% faster to run than its Cpp predecessor. Make of that what you will.
- lozenge 4y ago
  That's what they said. It aims for zero overhead abstractions.
- pkolaczk 4y ago
  > Safe Rust cannot represent circular data structures which makes entire classes of algorithms and architectures unimplementable. That's not accurate. Safe Rust can represent circular data structures. It cannot represent circular data structures with 0 overhead. But you can use Rc/Arc/Weak + RefCell for that and it is not very hard. Or use one of crates that expose ways of building self-referential structures in a safe way (of course they do use unsafe underneath, but the API is safe) like ouroboros.
timeon 4y ago
> Microsoft has been interested in using memory safe languages in the kernel for some time now. An example is the Midori project led by Joe Duffy back in 2009 which explored the idea with a C# derivative. There is also Project Verona.

hardware2win 4y ago

Project Midori was really good read, a lot of good stuff came from it https://joeduffyblog.com/2015/11/03/blogging-about-midori/ https://joeduffyblog.com/2015/11/03/blogging-about-midori/

ztnktl 4y ago

>Microsoft Windows ends up being the most secure general operating system It already is. What, exactly, is better than Windows at security features on desktop computers? Linux? There is nothing in there that comes even close to the defensive features of windows, like HVCI, a subsystem that checks for driver signatures and the likes isolated by virtualization mechanisms, which completely prevents tempering with the kernel. Linux's support for secure boot only exists to make it convenient to dual boot with windows, it doesn't do enough to prevent kernel level rootkits, it's a total placebo and it's even worse if you use a distro that doesn't have signed kernels, like Archlinux. If you're self signing on the same computer, how exactly are you stopping malware? Since Vista, the OS also gained some serious resilience against crashes that I have never seen on other operating systems. For example, it is possible for your desktop session to survive a GPU driver crash. On linux this is a guaranteed freeze or kernel panic. This is, fortunately, a rare event, but the last times I've seen my computer freeze on linux, it was always because of the graphic stack. openBSD's slogan for having few remotely exploitable exploits out of the box doesn't mention that it's because it has literally no features enabled out of the box. macOS and iOS are the systems with the greatest amount of privilege escalation fails by far. In fact, what do people think jailbreaks are? Some of which are truly frightening when you think about what could have been. Multiple jailbreaks were made that could be run just by browsing a webpage on safari. This means they punched through the browser, punched through privilege escalation and had the potential to install a rootkit on your phone. Just by visiting. A. Webpage. How many times such a thing has happened on Windows in the recent years? visiting a webpage installed a rootkit on your computer?

deleted 4y ago
[deleted]
hardware2win 4y ago
Anecdote: Ive tested a two or three years old Chrome version with JIT compiler vulnerability and guess what - on empty Linux vm it managed to escape chrome and execute code Meanwhile on Windows with Crowdstrike software installed Chrome just showed some error message about mem. access Im not sure who handled that attack - was it Windows or Crowdstrike, but eitherway Ive been impressed
- selfmodruntime 4y ago
  I can pretty much guarantee that the Windows kernel stopped unallowed memory access from chrome to outside apps.
- anthk 4y ago
  Under OpenBSD pledge and unveil would send that Chromium instance SIGABRT'ed. Your parent comment it's utterly wrong.
- sekh60 4y ago
  With or without SELinux enabled?
  - hardware2win 4y ago
    Idk, that was fresh instal
unnouinceput 4y ago
Hold your horses there my good friend. Yes, Windows is better now than it was in the past but is still a shitty OS. None of them are actually. All of them continuously fail every single year at hackers gathering/hackatons/whatever public event, with multiple zero-day showing. Every single major OS out there is a joke from security point of view.

ape4 4y ago

Well Linux is using Rust in the kernel too.

Narishma 4y ago
Not yet.
- pjmlp 4y ago
  The forked Android version is using it already for the last two years. Any Android 12 and later has a little bit of Rust taking care of the bluetooth communications driver.
  - Narishma 4y ago
    Is that only the case in Android?
    - pjmlp 4y ago
      That was only the begining, followed by Keystore2, the new Ultra-wideband (UWB) stack, DNS-over-HTTP3, Android’s Virtualization framework (AVF) on Android 13. https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html https://security.googleblog.com/2022/12/memory-safe-language... https://source.android.com/docs/setup/build/rust/building-rust-modules/overview https://source.android.com/docs/setup/build/rust/building-ru...

hgs3 4y ago

> Rust is a game changer in that it is built from the ground up to offer memory safety without garbage collection and still aims for zero overhead abstractions. Safe Rust cannot represent circular data structures which makes entire classes of algorithms and architectures unimplementable. You have to workaround these limitations by creating auxiliary structures for tracking references or use reference counting; neither are "zero overhead abstractions." Rust is only zero overhead if all you do is pass values up and down the call stack. Its false appeal says more about the simplistic types of applications folks are writing than anything else.

jackmott42 4y ago
Often the workaround to graph representations that safe Rust can't do with the usual pointer approach is faster. You keep the data in an array, which improves your cache hit rate. Even C++ programmers will often use the same workaround either for safety or performance reasons. As for overall performance in real programs, Rust seems to consistently do as well or better than C++ programs as the cases from Microsoft here show.
dralley 4y ago
> Safe Rust cannot represent circular data structures which makes entire classes of algorithms and architectures unimplementable In safe Rust. So just don't use safe Rust for those parts. Unsafe isn't evil, it's there for a reason. You should avoid it when possible and when there are no downsides, but sometimes there are, and that's ok.
yazaddaruvala 4y ago
The font parsing code was ported to 100% safe rust (other than the C FFI), and was 10-15% faster to run than its Cpp predecessor. Make of that what you will.
lozenge 4y ago
That's what they said. It aims for zero overhead abstractions.
pkolaczk 4y ago
> Safe Rust cannot represent circular data structures which makes entire classes of algorithms and architectures unimplementable. That's not accurate. Safe Rust can represent circular data structures. It cannot represent circular data structures with 0 overhead. But you can use Rc/Arc/Weak + RefCell for that and it is not very hard. Or use one of crates that expose ways of building self-referential structures in a safe way (of course they do use unsafe underneath, but the API is safe) like ouroboros.

timeon 4y ago

> Microsoft has been interested in using memory safe languages in the kernel for some time now. An example is the Midori project led by Joe Duffy back in 2009 which explored the idea with a C# derivative. There is also Project Verona.