3 ms·

Dynamic linking is something that I would personally like to see in Rustland too. But parent's point is that some issues that count as a CVE for Rust do not co

by nequo 3y ago

Dynamic linking is something that I would personally like to see in Rustland too. But parent's point is that some issues that count as a CVE for Rust do not count as such for C/C++ because the boundaries of undefined behavior are drawn elsewhere. This means that there are many fixes that are simply never made for C/C++, even though dynamic linking would make such a counterfactual fix easier to deploy.

megous 3y ago
Parent point was that such CVE could be fixed in Rust super cheaply (free) because code is maintained. If I have to reinstall the whole system to fix CVE in Rust stdlib in a brave new world where everything is written in Rust, then it's certainly not free fix.
- nequo 3y ago
  I actually think you're right. Apologies. I also don't see deploying a glibc fix as particularly costly.
- jacquesm 3y ago
  But we don't live in that brave new world and we're talking about now, not some hypothetical.