5 ms·

I agree the rewrite everything in Rust meme is overblown, and the Rust evangelists can be insufferable. I also agree that, at a glance, Rust syntax is (in my op

I agree the rewrite everything in Rust meme is overblown, and the Rust evangelists can be insufferable. I also agree that, at a glance, Rust syntax is (in my opinion) quite ugly. Once you start using the language it makes more sense why things are the way they are, but it was offputting to me at first and I still think its ugly now. However I don't think adding Rust support, rewriting old, critical components, using Rust for a new project, etc. are bad things. If someone volunteers to rewrite critical components in a way that eliminates (or significantly reduces) one of the most exploited and damaging classes of bugs, while also adding support for said way, then I don't see the problem. If someone opens a GitHub issue on your C++ project telling you to rewrite it in Rust, just close it and move on.

jdefr89 2y ago
I understand that. It is just they end up writing Rust code and then you go and see it's linked to libc or filled with "Unsafe". It isn't too difficult to write correct, safe C++. You can enable compiler settings that are similar to what Rust does.. On the critical bugs issue... To exploit a lot of these memory bugs it takes an entire new level of effort. We often need to chain together three or more bugs and land the exploit reliably.. This was much easier to do circa 2001 - 2016 but all the mitigations in place have really raised the bar.. From my experience providing exploits to a red teams that pen-test fortune 500 companies (my previous job at iDefense/FusionX), things have gotten far far more difficult. Rarely needed to use any advanced "sexy kill-chains" (like Chrome or IE exploit) because phishing and other means of network entry were far more reliable and much easier. My point is that study Google released expressed the bugs are dangerous and disastrous, yes, but they aren't the most prevalent risk in the real world. I am rambling a bit. Sorry for poor grammar typing on phone.

jdefr89 2y ago

I understand that. It is just they end up writing Rust code and then you go and see it's linked to libc or filled with "Unsafe". It isn't too difficult to write correct, safe C++. You can enable compiler settings that are similar to what Rust does.. On the critical bugs issue... To exploit a lot of these memory bugs it takes an entire new level of effort. We often need to chain together three or more bugs and land the exploit reliably.. This was much easier to do circa 2001 - 2016 but all the mitigations in place have really raised the bar.. From my experience providing exploits to a red teams that pen-test fortune 500 companies (my previous job at iDefense/FusionX), things have gotten far far more difficult. Rarely needed to use any advanced "sexy kill-chains" (like Chrome or IE exploit) because phishing and other means of network entry were far more reliable and much easier. My point is that study Google released expressed the bugs are dangerous and disastrous, yes, but they aren't the most prevalent risk in the real world. I am rambling a bit. Sorry for poor grammar typing on phone.