2 ms·

I'd think logic bugs are the majority of CVEs, and rust doesn't magically make those go away

• woodruffw 2y ago
  The "majority of CVEs" isn't a great metric, since (1) anybody can file a CVE, and (2) CNAs can be tied to vendors, who are incentivized to pre-filter CVEs or not issue CVEs at all for internal incidents. Thankfully, we have better data sources. Chromium estimates that 70% of serious security bugs in their codebases stem from memory unsafety[1], and MSRC estimates a similar number for Microsoft's codebases[2]. (General purpose programming languages can't prevent logic bugs. However, I would separately argue that idiomatic Rust programs are less likely to experience classes of logic bugs that are common in C and C++ programs, in part because strong type systems can make invalid states unrepresentable.) [1]: https://www.chromium.org/Home/chromium-security/memory-safety/ https://www.chromium.org/Home/chromium-security/memory-safet... [2]: https://msrc.microsoft.com/blog/2019/07/we-need-a-safer-systems-programming-language/ https://msrc.microsoft.com/blog/2019/07/we-need-a-safer-syst...