5 ms·

This seems worthwhile at first sight; another implementation (in a different language) gives us more choice and time will tell on the CVE count:user ratio.

by zh3 3y ago

anthk 3y ago
Find an error on the Rust runtime and then the whole security collapses down as a house of cards. It's bad to think on security by just using a language.
- lalaithion 3y ago
  I mean, the same is true with the C runtime.
  - hulitu 3y ago
    > I mean, the same is true with the C runtime. My c compiler does not connect to internet during compiling.
    - some_furry 3y ago
      What do you do if a dependent .so isn't found? Do you not have to install said dependency from the Internet and start (at least part of) the compile over?
    - overthrow 3y ago
      Nor does the Rust compiler. Rust's build system, Cargo, does however. And many C build systems do as well, e.g. https://cmake.org/cmake/help/latest/guide/using-dependencies/index.html#downloading-and-building-from-source-with-fetchcontent https://cmake.org/cmake/help/latest/guide/using-dependencies...
      - steveklabnik 3y ago
        Optionally. Cargo doesn’t have to connect to the internet, and even has command line switches to fail if it tries to.
        hulitu 3y ago
        Good to know.
      - hulitu 3y ago
        Thank you for the tip. I shall do ifconfig eth0 down before compiling to avoid such issues.
  - ittan 3y ago
    Isn't "C Runtime" inaccurate? Wouldn't it be the static or dynamic linked libraries for the particular program in question?
    - pjmlp 3y ago
      Nope, what do you think calls into main(), does floating point emulation, handles signals on non UNIX platforms, provides threading support?
      - dahfizz 3y ago
        The term "runtime" is overloaded here. The C runtime is not what people usually mean when they say a language has a runtime. There is a crt.0 "C Runtime" object. This is code that is literally run "at runtime". When you execute a binary, the C runtime is the first thing executed to setup the stack and call main(). This is just a bit of assembly that runs before main(). It shares ~nothing in common with "runtime" languages like Python or Java where the runtime is alive during the whole program's execution. The C run time does not handle floats or threads or anything like that. Software floats are dealt with by the compiler and threading is implemented as its own library (either in userspace or built into the kernel).
        pjmlp 3y ago
        I guess you can educate Microsoft on that then. https://learn.microsoft.com/en-us/cpp/c-runtime-library/c-run-time-library-reference?view=msvc-170 https://learn.microsoft.com/en-us/cpp/c-runtime-library/c-ru... It doesn't matter what people think, rather the CS point of view of a language runtime is. That library is the runtime. C implementation without the respective runtime is what is called a freestanding implementation as per ISO C.
      - lanstin 3y ago
        Libraries and crt0.o and the like. Libgcc_s ; but it isn’t a runtime in the sense that some magic is doing GC or scheduling for routines. ABI that describes what the assembly should be doing, it isn’t a thing doing stuff.
- smt88 3y ago
  No one is saying they should switch languages and stop all other security work.
- hulitu 3y ago
  No need for errors. Just a compromised package on crates.io. It's funny how rust is praised as secure without any code audit.
  - iknowstuff 3y ago
    Yeah your single header libs from pastebin get so many audits by comparison. https://github.com/RustSec/rustsec/tree/main/cargo-audit https://github.com/RustSec/rustsec/tree/main/cargo-audit https://mozilla.github.io/cargo-vet/ https://mozilla.github.io/cargo-vet/ Besides, every dependency is locked.
  - haswell 3y ago
    Security means many things, and supply chain vulnerabilities are just one of many factors to evaluate when considering languages. Rust improves or eliminates some issues, but that does not imply that other issues are magically solved.
  - fnordpiglet 3y ago
    I don’t think people generally say secure, they say safe. Safe is necessary but insufficient for secure. The existing implementations assume safety by diligence. Rust promises safety by construction. That’s useful. But, to your point, insufficient. People that say secure when they mean safe are just wrong.
- MattPalmer1086 3y ago
  Rust doesn't have a runtime. Nobody is suggesting that a language solves all security issues. It does have much better memory safety than C, which is the cause of the majority of security issues.
  - duped 3y ago
    Rust has a minimal runtime (0), and links to libc by default which brings in the libc runtime (so it's not like C is any better). Except that the Rust runtime is written in Rust, which is nice for memory safety. (0) https://prev.rust-lang.org/en-US/faq.html#does-rust-have-a-runtime https://prev.rust-lang.org/en-US/faq.html#does-rust-have-a-r...
    - MattPalmer1086 3y ago
      Well, opinions in the Rust community clearly differ: "Rust is blazingly fast and memory-efficient: with no runtime or garbage collector" [0] I guess it depends on what you mean by a runtime. Panic handlers and initialisation code is a pretty small runtime. [0] https://www.rust-lang.org/ https://www.rust-lang.org/
- samus 3y ago
  Even if there are error, the impact of each error would not be higher than if it occurred in libc or any other language runtime.
3a2d29 3y ago
Yeah agree with this, will be interesting to see. I assume the more unsafe rust used, the more the CVE numbers will appear like C and C++. People like to say unsafe means "I checked this and this is fine, compiler" and isn't a bad thing but I feel that's inaccurate since the whole point of rust is that people struggle to write safe code even when they are really checking. I feel unsafe rust is way more "I really hope this is right, but I have minimized it to just this area out of necessity, since it likely isn't." I would like to see how much CVEs go down over time. The fact sudo is being rewritten suggests that even after long periods of use, security issues popping up is still a common-ish problem?
- arp242 3y ago
  > security issues popping up is still a common-ish problem? It seems to average out at a bit over 1 per year over the last 20 years, based on [1]; is that "a lot"? I guess? It's worth pointing out that while there certainly are memory-related C-style issues, quite a few are logic errors because all of this is rather subtle once you start adding features beyond what e.g. "doas" does. For example the recent "Sudoedit can edit arbitrary files"[2] is a somewhat subtle interaction between sudoedit, environment variables, and flag parsing. Previously there was [3] and [4] from 2004 and 2010. Will memory safety be a benefit? Of course it will. But I think these kind of issues are the real challenge here. A drop-in replacement for "sudo" is useful, but I have to wonder if it wouldn't be better to rethink the approach from first principles, taking 40 years of sudo lessons in to account. It's also surprisingly easy to shoot yourself in the foot with a wrong sudoers file, which is not strictly a security issue in sudo as such but also something that can probably be improved on? That 2023 sudoedit bug has been in sudo since 1.8, released in 2011, and Todd has been maintaining sudo since 1994, and he's actually pretty good as well as experienced with this kind of stuff. Yet he still missed it, as did everyone else, for well over ten years. It seems there are far more structural problems in the entire approach that go well beyond "C is not memory safe". That's certainly an issue, but in a way seems almost banal compared to the deeper issues. [1]: https://www.sudo.ws/security/advisories/ https://www.sudo.ws/security/advisories/ [2]: https://www.sudo.ws/security/advisories/sudoedit_any/ https://www.sudo.ws/security/advisories/sudoedit_any/ [3]: https://www.sudo.ws/security/advisories/sudoedit_escalate2/ https://www.sudo.ws/security/advisories/sudoedit_escalate2/ [4]: https://www.sudo.ws/security/advisories/sudoedit/ https://www.sudo.ws/security/advisories/sudoedit/
ChancyChance 3y ago
How would I find the CVE's on sudo/su? I opened up mitre.org and cve.org, but searches for sudo/su brought up hundreds of issues (or more), and most of them were not about sudo/su. (It's a bit like searching for "The The"'s music on early Google.)
- arp242 3y ago
  There's [1], which I think is comprehensive from 2001 up to today. [1]: https://www.sudo.ws/security/advisories/ https://www.sudo.ws/security/advisories/

This seems worthwhile at first sight; another implementation (in a different language) gives us more choice and time will tell on the CVE count:user ratio.

by zh3 3y ago

This seems worthwhile at first sight; another implementation (in a different language) gives us more choice and time will tell on the CVE count:user ratio.

anthk 3y ago

Find an error on the Rust runtime and then the whole security collapses down as a house of cards. It's bad to think on security by just using a language.

lalaithion 3y ago
I mean, the same is true with the C runtime.
- hulitu 3y ago
  > I mean, the same is true with the C runtime. My c compiler does not connect to internet during compiling.
  - some_furry 3y ago
    What do you do if a dependent .so isn't found? Do you not have to install said dependency from the Internet and start (at least part of) the compile over?
  - overthrow 3y ago
    Nor does the Rust compiler. Rust's build system, Cargo, does however. And many C build systems do as well, e.g. https://cmake.org/cmake/help/latest/guide/using-dependencies/index.html#downloading-and-building-from-source-with-fetchcontent https://cmake.org/cmake/help/latest/guide/using-dependencies...
    - steveklabnik 3y ago
      Optionally. Cargo doesn’t have to connect to the internet, and even has command line switches to fail if it tries to.
      - hulitu 3y ago
        Good to know.
    - hulitu 3y ago
      Thank you for the tip. I shall do ifconfig eth0 down before compiling to avoid such issues.
- ittan 3y ago
  Isn't "C Runtime" inaccurate? Wouldn't it be the static or dynamic linked libraries for the particular program in question?
  - pjmlp 3y ago
    Nope, what do you think calls into main(), does floating point emulation, handles signals on non UNIX platforms, provides threading support?
    - dahfizz 3y ago
      The term "runtime" is overloaded here. The C runtime is not what people usually mean when they say a language has a runtime. There is a crt.0 "C Runtime" object. This is code that is literally run "at runtime". When you execute a binary, the C runtime is the first thing executed to setup the stack and call main(). This is just a bit of assembly that runs before main(). It shares ~nothing in common with "runtime" languages like Python or Java where the runtime is alive during the whole program's execution. The C run time does not handle floats or threads or anything like that. Software floats are dealt with by the compiler and threading is implemented as its own library (either in userspace or built into the kernel).
      - pjmlp 3y ago
        I guess you can educate Microsoft on that then. https://learn.microsoft.com/en-us/cpp/c-runtime-library/c-run-time-library-reference?view=msvc-170 https://learn.microsoft.com/en-us/cpp/c-runtime-library/c-ru... It doesn't matter what people think, rather the CS point of view of a language runtime is. That library is the runtime. C implementation without the respective runtime is what is called a freestanding implementation as per ISO C.
    - lanstin 3y ago
      Libraries and crt0.o and the like. Libgcc_s ; but it isn’t a runtime in the sense that some magic is doing GC or scheduling for routines. ABI that describes what the assembly should be doing, it isn’t a thing doing stuff.
smt88 3y ago
No one is saying they should switch languages and stop all other security work.
hulitu 3y ago
No need for errors. Just a compromised package on crates.io. It's funny how rust is praised as secure without any code audit.
- iknowstuff 3y ago
  Yeah your single header libs from pastebin get so many audits by comparison. https://github.com/RustSec/rustsec/tree/main/cargo-audit https://github.com/RustSec/rustsec/tree/main/cargo-audit https://mozilla.github.io/cargo-vet/ https://mozilla.github.io/cargo-vet/ Besides, every dependency is locked.
- haswell 3y ago
  Security means many things, and supply chain vulnerabilities are just one of many factors to evaluate when considering languages. Rust improves or eliminates some issues, but that does not imply that other issues are magically solved.
- fnordpiglet 3y ago
  I don’t think people generally say secure, they say safe. Safe is necessary but insufficient for secure. The existing implementations assume safety by diligence. Rust promises safety by construction. That’s useful. But, to your point, insufficient. People that say secure when they mean safe are just wrong.
MattPalmer1086 3y ago
Rust doesn't have a runtime. Nobody is suggesting that a language solves all security issues. It does have much better memory safety than C, which is the cause of the majority of security issues.
- duped 3y ago
  Rust has a minimal runtime (0), and links to libc by default which brings in the libc runtime (so it's not like C is any better). Except that the Rust runtime is written in Rust, which is nice for memory safety. (0) https://prev.rust-lang.org/en-US/faq.html#does-rust-have-a-runtime https://prev.rust-lang.org/en-US/faq.html#does-rust-have-a-r...
  - MattPalmer1086 3y ago
    Well, opinions in the Rust community clearly differ: "Rust is blazingly fast and memory-efficient: with no runtime or garbage collector" [0] I guess it depends on what you mean by a runtime. Panic handlers and initialisation code is a pretty small runtime. [0] https://www.rust-lang.org/ https://www.rust-lang.org/
samus 3y ago
Even if there are error, the impact of each error would not be higher than if it occurred in libc or any other language runtime.

3a2d29 3y ago

Yeah agree with this, will be interesting to see. I assume the more unsafe rust used, the more the CVE numbers will appear like C and C++. People like to say unsafe means "I checked this and this is fine, compiler" and isn't a bad thing but I feel that's inaccurate since the whole point of rust is that people struggle to write safe code even when they are really checking. I feel unsafe rust is way more "I really hope this is right, but I have minimized it to just this area out of necessity, since it likely isn't." I would like to see how much CVEs go down over time. The fact sudo is being rewritten suggests that even after long periods of use, security issues popping up is still a common-ish problem?

arp242 3y ago
> security issues popping up is still a common-ish problem? It seems to average out at a bit over 1 per year over the last 20 years, based on [1]; is that "a lot"? I guess? It's worth pointing out that while there certainly are memory-related C-style issues, quite a few are logic errors because all of this is rather subtle once you start adding features beyond what e.g. "doas" does. For example the recent "Sudoedit can edit arbitrary files"[2] is a somewhat subtle interaction between sudoedit, environment variables, and flag parsing. Previously there was [3] and [4] from 2004 and 2010. Will memory safety be a benefit? Of course it will. But I think these kind of issues are the real challenge here. A drop-in replacement for "sudo" is useful, but I have to wonder if it wouldn't be better to rethink the approach from first principles, taking 40 years of sudo lessons in to account. It's also surprisingly easy to shoot yourself in the foot with a wrong sudoers file, which is not strictly a security issue in sudo as such but also something that can probably be improved on? That 2023 sudoedit bug has been in sudo since 1.8, released in 2011, and Todd has been maintaining sudo since 1994, and he's actually pretty good as well as experienced with this kind of stuff. Yet he still missed it, as did everyone else, for well over ten years. It seems there are far more structural problems in the entire approach that go well beyond "C is not memory safe". That's certainly an issue, but in a way seems almost banal compared to the deeper issues. [1]: https://www.sudo.ws/security/advisories/ https://www.sudo.ws/security/advisories/ [2]: https://www.sudo.ws/security/advisories/sudoedit_any/ https://www.sudo.ws/security/advisories/sudoedit_any/ [3]: https://www.sudo.ws/security/advisories/sudoedit_escalate2/ https://www.sudo.ws/security/advisories/sudoedit_escalate2/ [4]: https://www.sudo.ws/security/advisories/sudoedit/ https://www.sudo.ws/security/advisories/sudoedit/

ChancyChance 3y ago

How would I find the CVE's on sudo/su? I opened up mitre.org and cve.org, but searches for sudo/su brought up hundreds of issues (or more), and most of them were not about sudo/su. (It's a bit like searching for "The The"'s music on early Google.)

arp242 3y ago
There's [1], which I think is comprehensive from 2001 up to today. [1]: https://www.sudo.ws/security/advisories/ https://www.sudo.ws/security/advisories/