5 ms·
> Moving to Rust would ... ... do absolutely nothing to fix denial of service attacks.
by otabdeveloper4 3y ago
> Moving to Rust would ...
... do absolutely nothing to fix denial of service attacks.
- tob_scott_a 3y agoBy itself? No. The other details covered in the blog post, however, would absolutely do something to fix denial of service attacks. To wit: x509-limbo
- woodruffw 3y agoI don't think this is true. Rust cannot prevent all possible forms of denial of service, but there are plenty of underlying DoS causes that Rust either outright eliminates (such as memory corruption without further control) or mitigates through stronger types. A recent example of this is CVE-2024-0567 in GnuTLS: an invariant that otherwise would likely have been noticed at the type level is instead checked with an assert, leading to a remotely trigger-able DoS.
- saurik 3y agoNor the other myriad of logic and parsing bugs that led to incorrect behavior (more than just denial of service) in the Java library that was somehow not as good as Rust :/.
- bagels 3y agoExploiting a memory safety crash, leading to a downed service, is the first class of DOS that Rust can help with.