4 ms·
At least my usecase has C completely disconnected from the internet. I have no idea how this is going to work at the OS level.
by hospitalJail 3y ago
At least my usecase has C completely disconnected from the internet.
I have no idea how this is going to work at the OS level.
- wyldfire 3y agoWhat is the "this" referred to here?
- deleted 3y ago[deleted]
- tines 3y agoThe title of the post: using memory-safe languages.
- wyldfire 3y agoSo it's your contention that the comment should read, "At least my usecase has C completely disconnected from the internet. I have no idea how [using memory-safe languages] is going to work at the OS level." I struggle to understand the comment. Do these two sentences relate to one another or is the second one a non-sequitur?
- dharmab 3y agoBased on early days of Rust in the Linux kernel, the segmentation of safe and unsafe code can significantly reduce the surface area within a kernel.
- carlmr 3y agoI mean it's obvious why it works. The less code that has to be heavily scrutinized for memory issues, the more the few people that can scrutinize such code can focus on the parts that still need that level of scrutiny.
- ethbr1 3y agoThat was the most brilliant part of Rust lang design, when I thought about it. There will always need to be unsafe ops in highest performance, low level coding. But in the vast majority of use cases, there only need to be a few. So huge security win being able to isolate those vs "somewhere in the entire codebase."
- candiddevmike 3y agoDo you rewrite the Linux kernel as-is in Rust or try something new? Would/should a Linux in Rust look the same?
- lambdaone 3y agoAs other commenters have said, you can do it a bit at a time, converting non-core kernel code to Rust at the edges. Another route to memory (and other) safety would be the C -> WASM -> C route that effectively rewrites/transpiles code to operate within its own sandbox, which also has the advantage that it could at some later date support modules written in languages other than C.
- Zambyte 3y agoI realize this is beating a dead horse, but it really is a shame that microkernels didn't win for human-facing Unix systems. This issue was recognized and basically solved decades ago, and we're still almost there.
- ianlevesque 3y agoYeah, I've wondered a bit if the Spectre class of vulnerabilities was discovered a couple decades sooner if it would have changed the course of history there.
- nobleach 3y agoHurd any day now, right? I do wonder what this landscape could have looked like if all of the effort had gone behind a Mach-based microkernel. I read all of the back and forth between Tanenbaum and Torvalds. At the time, I was just so excited to see "free and open" winning. I should specify that the XNU Kernel from Darwin/OSX took a lot of my attention when it first premiered.
- Zambyte 3y agoHurd works in the same sense that OpenBSD works. It has very limited hardware support so you'll likely have to run it in a VM, but it does work.
- ElectricalUnion 3y agoIf you're willing to split your workload into VMs in the first place I think application-level segmentation like Qubes starts to become a more interesting idea that microkernels.
- Zambyte 3y agoThere is a lot of flexibility that you get from microkernels outside of isolation that you don't get from virtual machines. I'm not suggesting use one GNU/Hurd VM for one application (similar to what you would get with Qubes). I'm suggesting using one GNU/Hurd VM for many applications.
- Santosh83 3y agoWhat's the uptake of Rust as far as Linux kernel dev goes? Is it being positively welcomed and seeing a rise in usage or is it still at PoC stage? Any ongoing rewrites of important subsystems?
- mambru 3y agoSo far 61 files [0], vs 52k for C, so about 0.1%. [0]: https://github.com/search?q=repo%3Atorvalds%2Flinux++language%3ARust+&type=code https://github.com/search?q=repo%3Atorvalds%2Flinux++languag...
- lambdaone 3y agoIt may not be much at the moment, but the thing that I find encouraging is that there seems to be very little pushback against it; the sanity of the Rust approach is very much accepted now.
- dharmab 3y agoMost of the interesting work is not yet upstreamed. A particularly interesting example is the Apple Sillicon GPU driver in Asahi Linux.
- a_humean 3y agoLast I checked still very early days with most of the work/experimentation happening in the driver space. However, it doesn't seem like its facing a lot of resistence and Torvalds seems reasonably positive about it atm.
- andrewmutz 3y agoCrossing an air gap hasn't stopped a determined attacker in the past: https://en.m.wikipedia.org/wiki/Stuxnet https://en.m.wikipedia.org/wiki/Stuxnet
- baseballdork 3y agoLet's be real. Creating an air gap hasn't stopped a very few, unlimited resource, APTs. Don't let perfect be the enemy of good enough.
- zaphar 3y agoTo really be real if air-gapping is a significant mitigation for your risk profile then you are likely the target of one of those rare APT's. You should probably also be using a memory safe language if you think you need air gapping.
- baseballdork 3y agoI agree, but I don't think the OP was saying APTs are in their threat profile.
- checker659 3y agoYou can shoot yourself in the foot as well. Memory safety isn't just about malicious thirdparty code.
- adrianN 3y agoA lot of industrial automation was built with an offline usecase in mind. Then someone invented the IIoT.
- stjohnswarts 3y agoThe Internet Internet of Things?
- wyldfire 3y agoIIoT stands for "Industrial Internet of Things"