2 ms·
Memory safety comes to mind. Maintainability is another. I don’t recall if file(1) is part of coreutils or not, but there was a somewhat unexpected exploit fo
by sneak 3y ago
Memory safety comes to mind. Maintainability is another.
I don’t recall if file(1) is part of coreutils or not, but there was a somewhat unexpected exploit for it a few years ago.
- xyzzy123 3y agoMost of this stuff tends not to run in a privileged / network context so it's not clear to me that there are big security gains to be had? To be fair there are daemons and scripts that shell out to these things and when all the stars align you maybe get an exploitable scenario - but these tend to be situations where doing that in the first place was a bad idea (e.g. $PAGER is not meant to be a load bearing security component and rewriting in Rust is unlikely to fix all the issues with this class of usage).
- roca 3y agoWhenever you run one of these tools on a file you downloaded from the Internet, you're relying on the tool having no exploitable security bugs. Regardless of whether or not $PAGER was intended to be a "load bearing security component", it definitely is.
- ok123456 3y agoThe lifetime of these programs is maybe a hundred milliseconds. You could write "memory safe" versions of them by just not using "free" in C, as many early versions of these tools did.