4 ms·

Well, a fix in glibc fixed it across the whole system and for all already compiled programs. Can you say the same for Rust?

• nequo 3y ago
  Dynamic linking is something that I would personally like to see in Rustland too. But parent's point is that some issues that count as a CVE for Rust do not count as such for C/C++ because the boundaries of undefined behavior are drawn elsewhere. This means that there are many fixes that are simply never made for C/C++, even though dynamic linking would make such a counterfactual fix easier to deploy.
  • megous 3y ago
    Parent point was that such CVE could be fixed in Rust super cheaply (free) because code is maintained. If I have to reinstall the whole system to fix CVE in Rust stdlib in a brave new world where everything is written in Rust, then it's certainly not free fix.
    • nequo 3y ago
      I actually think you're right. Apologies. I also don't see deploying a glibc fix as particularly costly.
    • jacquesm 3y ago
      But we don't live in that brave new world and we're talking about now, not some hypothetical.