4 ms·

And yet we can also just look at how memory vulnerabilities have impacted the Linux kernel over the years in order to assess how much they have helped to reduce

by mdhb 2y ago

And yet we can also just look at how memory vulnerabilities have impacted the Linux kernel over the years in order to assess how much they have helped to reduce the risk that memory unsafe languages bring.

kstrauser 2y ago
You're right, and it's not just memory safety in the use-after-free sense. I just had to audit some out-of-bounds read CVEs, like https://nvd.nist.gov/vuln/detail/CVE-2024-46723 https://nvd.nist.gov/vuln/detail/CVE-2024-46723. Rust really makes you work hard to read past the end of an array.
- uecker 2y ago
  Rust makes a lot of things hard. Update: From your CVE "Clear warning that read ucode[] may out-of-bounds." So it seems this was catched by tooling.
  - kstrauser 2y ago
    …after public release. It’s nicer when tooling catches problems before it successfully compiles.
    - uecker 2y ago
      Not if this means horrible long compilation times. I agree it should be catched before a release. But this is a question of procedures and not of programming language.