4 ms·
There's a kind of naive thing going on on HN where peopel see a bug and ask whether or assert Rust will fix it. The problem is they are homing in on just the bu
by foobiekr 3y ago
There's a kind of naive thing going on on HN where peopel see a bug and ask whether or assert Rust will fix it. The problem is they are homing in on just the bugs Rust addresses - this is fine, I've had this conversation at work (not involving Rust, even) for two decades, including discussions about Java.
The problem is that Rust solves _a_ class of issues without even beginning to address other kinds of problems, and so this sort of thinking is evolving toward a mindset that "oh it's rust so no security issues", which is completely wrong.
- eichin 3y agoPerhaps an innoculation against this is to respond "Yes, but so would Ada"
- pjmlp 3y agoI keep using "mostly safe languages" as kind of abstract term, Rust comes into speech even in scenarios where other alternatives would be a viable option.
- foobiekr 3y agoAda is such a lost opportunity honestly. As powerful as C, performant and clean.
- pjmlp 3y agoUnfortunely did not come with an OS, wasn't freely available, and quite costly. Remeber that until AT&T was allowed to take commercial advantage of UNIX, its source code was available for a symbolic price, and it came with a C compiler toolchain, at least until Sun started the trend among UNIX vendors of spliting UNIX development tools into an additional purchase. The UNIX vendors that had Ada compilers, that was an additional purchase on top of UNIX SDK (which already had C and C++), so unless there was a hard requirement to use Ada, no one bothered to pay extra.
- foobiekr 3y agoIndeed. Ada killed itself, partially because it was one of the DoD approved languages and so the vendors got on board with raping and pillaging everything they could, killing the whole thing in the process.
- IshKebab 3y agoI don't think so. Rust solve a class of security issue, but that class is 2/3 of all security issues! That's overwhelmingly more secure. And it's not like it has no effect on the final third either. The stronger type system and ownership system make non-memory related bugs less likely too. Your comment makes it sound as if you have a better solution. But Rust is the best one we know so far, so this kind of naysaying does more harm than good.
- armitron 3y agoDo you realize how many security issues exist in applications written in memory-safe Java/PHP/JS/Python ? Memory corruption is but the tip of the iceberg.
- xcdzvyn 3y agoYou are right that there are software bugs that aren't memory bugs. Now as GP was saying, Rust inherently mitigates a great deal of generally serious software vulnerabilities, which is great, even if it doesn't mitigate anything else.
- IshKebab 3y agoMemory corruption is literally 2/3 of the iceberg. Look it up.
- deleted 3y ago[deleted]
- GoblinSlayer 3y agoNaysaying is that these problems can't be fixed in C, this kind of naysaying does more harm than good. Rust merely uses an idea that was known before C even existed.