12 ms·

Duplicate, more discussion here: https://news.ycombinator.com/item?id=39194093 https://news.ycombinator.com/item?id=39194093

wslh 3y ago
I have not found Rust mentioned there. Am I right if we say that using Rust will reduce the security attack surface in Linux? I see now it is mentioned in this thread and there are different views about this.
- tialaramex 3y ago
  The obvious ways to do this in Rust are safe, on the other hand, if you write some Rust where all it does is call this glibc function then Rust didn't magically save you because the function is broken. Does that help?
- smolder 3y ago
  Being that it is a buffer overflow, yes, if glibc were in Rust I think it shouldn't have happened. I believe I saw a libc reimplementation project in Rust, but that's a big effort and not something I would expect to be drop-in for a long time. That said, I think we should try to avoid turning every vulnerability discussion into one about the merits of Rewriting it in Rust.
- stevev96 3y ago
  [dead]
- shirro 3y ago
  Memory safety isn't exclusive to Rust. Language designers and implementers solved these problems years ago with safer languages (better type systems, removing pointers) or safer runtimes (jvm, .net etc). Rust is notable because it brings a lot of prior art together in one place and the compiler prevents most problems at compile time. As long as programmers don't use unsafe Rust it can produce safer code without runtime overhead. There are a lot of safer languages than C. Not all are suitable for writing system libraries.
  - WirelessGigabit 3y ago
    Mind you that there is a runtime overhead. If we look at access beyond on a slice's boundary: https://github.com/rust-lang/rust/blob/ea37e8091fe87ae0a7e204c034e7d55061e56790/library/core/src/slice/index.rs#L315-L322 https://github.com/rust-lang/rust/blob/ea37e8091fe87ae0a7e20... This bounds check is what enables Rust code to fail with a panic vs continuing (which is what triggers a lot of bugs). Post about the impact on performance: https://blog.readyset.io/bounds-checks/ https://blog.readyset.io/bounds-checks/
- deleted 3y ago
  [deleted]
- nextaccountic 3y ago
  Yes, but only if the relevant code can be written in Safe Rust (that is, without using unsafe). This is not always a given, but surprisingly, a huge amount of code can be written in Safe Rust and therefore won't have buffer overflows.
- GoblinSlayer 3y ago
  FWIW C can do it too to some extent, here's postfix: https://github.com/vdukhovni/postfix/blob/master/postfix/src/util/base64_code.c https://github.com/vdukhovni/postfix/blob/master/postfix/src...

wslh 3y ago

I have not found Rust mentioned there. Am I right if we say that using Rust will reduce the security attack surface in Linux? I see now it is mentioned in this thread and there are different views about this.

tialaramex 3y ago
The obvious ways to do this in Rust are safe, on the other hand, if you write some Rust where all it does is call this glibc function then Rust didn't magically save you because the function is broken. Does that help?
smolder 3y ago
Being that it is a buffer overflow, yes, if glibc were in Rust I think it shouldn't have happened. I believe I saw a libc reimplementation project in Rust, but that's a big effort and not something I would expect to be drop-in for a long time. That said, I think we should try to avoid turning every vulnerability discussion into one about the merits of Rewriting it in Rust.
stevev96 3y ago
[dead]
shirro 3y ago
Memory safety isn't exclusive to Rust. Language designers and implementers solved these problems years ago with safer languages (better type systems, removing pointers) or safer runtimes (jvm, .net etc). Rust is notable because it brings a lot of prior art together in one place and the compiler prevents most problems at compile time. As long as programmers don't use unsafe Rust it can produce safer code without runtime overhead. There are a lot of safer languages than C. Not all are suitable for writing system libraries.
- WirelessGigabit 3y ago
  Mind you that there is a runtime overhead. If we look at access beyond on a slice's boundary: https://github.com/rust-lang/rust/blob/ea37e8091fe87ae0a7e204c034e7d55061e56790/library/core/src/slice/index.rs#L315-L322 https://github.com/rust-lang/rust/blob/ea37e8091fe87ae0a7e20... This bounds check is what enables Rust code to fail with a panic vs continuing (which is what triggers a lot of bugs). Post about the impact on performance: https://blog.readyset.io/bounds-checks/ https://blog.readyset.io/bounds-checks/
deleted 3y ago
[deleted]
nextaccountic 3y ago
Yes, but only if the relevant code can be written in Safe Rust (that is, without using unsafe). This is not always a given, but surprisingly, a huge amount of code can be written in Safe Rust and therefore won't have buffer overflows.
GoblinSlayer 3y ago
FWIW C can do it too to some extent, here's postfix: https://github.com/vdukhovni/postfix/blob/master/postfix/src/util/base64_code.c https://github.com/vdukhovni/postfix/blob/master/postfix/src...