6 ms·
In the age of Rust, I wonder if CVE is even necessary anymore.
by meindnoch 2y ago
In the age of Rust, I wonder if CVE is even necessary anymore.
- ziddoap 2y agoI can never tell when someone posts something like this if it is a joke or not. In case it isn't, there are many weaknesses and vulnerabilities which Rust does not protect from.
- grayhatter 2y agoEven if they are joking, no matter how hyperbolic or satirical, someone absolutely believes it as true. I've heard people advocating for rust because they genuinely believe it prevents all software exploits. Security comprehension is frighteningly low among SWEs.
- marcusb 2y agoTaking this at face value, please see the Rustsec advisory database for prima facie evidence that vulnerability enumeration is still necessary https://rustsec.org/advisories/ https://rustsec.org/advisories/
- goku12 2y agoPlease don't drag Rust into needless controversies like this. Rust does improve the situation. But not even the language developers will make such bold claims. To begin with, memory safety errors aren't the only source of security bugs. The simplest example is an SQL injection attack. Besides, almost all Rust programs contain hidden unsafe code. You can check the standard library if you don't believe me. Memory safety in Rust depends on verification of those unsafe interfaces. The chance of having such bugs is pretty low since they are widely reviewed (this is the point of Rust unsafe). But such errors do occur sometimes and are reported from time to time.