2 ms·
Could you elaborate on this? I'm not sure what you mean; are you saying that there will still be vulnerabilities that are of similar difficulty to exploit as w
by kelnos 2y ago
Could you elaborate on this? I'm not sure what you mean; are you saying that there will still be vulnerabilities that are of similar difficulty to exploit as would be found in a C bootloader, but will be harder to find by security researchers? Or are you just saying that there will be fewer vulnerabilities, but the ones that do exist will be more "obscure" than would be the case if it were written in C, because Rust eliminates some of the more "obvious" vectors?
Either way, do you consider this a bad thing?
- yjftsjthsd-h 2y agoIt's neither of those. The trade-off is that features like this are often used against users, preventing them from actually controlling their own machines. Under those circumstances, bugs in the "security" of the machine are a mixed bag: malware can exploit them to break out, but users can exploit them to get full control over the machine that they own. This has happened with Android phones, for instance, allowing people to root phones and/or replace the ROM with a community version that gets security patches not available in the stock ROM, which is probably a net security improvement even with the bootloader left vulnerable. So it's really hard to call it a good thing or a bad thing; it's a trade.