4 ms·

Memory safety is strictly a good thing, regardless of motivations. But I'm aware that some people are frightened of new languages and paradigms especially if t

Memory safety is strictly a good thing, regardless of motivations. But I'm aware that some people are frightened of new languages and paradigms especially if they're 'harder' than what they're used to.

davrosthedalek 1y ago
Only if you don't buy any downsides with it. That makes it situational dependent. For example: - less people being able to read the code, work with the code, find (security) bugs - slower I know, I know, rust is not really slower, and for sudo it probably wouldn't even matter. But safety isn't the be all and end all of software. There is a lot of software out there where memory safety doesn't matter, or matters a lot less than other aspects.
- 778464636 1y ago
  Supply chain attacks is a big downside no one ever mentions. Even sudo-rs drags dependencies in from Github at build time instead of being self-contained, which is just an absurd thing to do for such an essential tool, especially in the current political climate.
  - estebank 1y ago
    1) every dependency comes from crates.io, not straight from GitHub 2) the dependency list is tiny 3) it uses a cargo lock, so even if it were using a GitHub dependency, that file keeps a hash of the dependency and points at the specific commit, so if the dependency were to introduce a backdoor it wouldn't be automatically picked up and a commit history rewrite would also fail https://github.com/trifectatechfoundation/sudo-rs/blob/main/Cargo.lock https://github.com/trifectatechfoundation/sudo-rs/blob/main/...
FpUser 1y ago
>"But I'm aware that some people are frightened of new languages..." I am not frightened. I program in many languages and have no problems grasping Rust concepts. However I find Rust way too opinionated and restricting for personal tastes. For business I can not see myself replacing C++ with Rust unless my paying clients specifically request it. So far not a single one had expressed any interest.
drtgh 1y ago
This is not a new paradigm. It is a limitation in the design of the borrow checker, which causes you to go around until the borrowing takes on mainly a tree structure.

davrosthedalek 1y ago

Only if you don't buy any downsides with it. That makes it situational dependent. For example: - less people being able to read the code, work with the code, find (security) bugs - slower I know, I know, rust is not really slower, and for sudo it probably wouldn't even matter. But safety isn't the be all and end all of software. There is a lot of software out there where memory safety doesn't matter, or matters a lot less than other aspects.

778464636 1y ago
Supply chain attacks is a big downside no one ever mentions. Even sudo-rs drags dependencies in from Github at build time instead of being self-contained, which is just an absurd thing to do for such an essential tool, especially in the current political climate.
- estebank 1y ago
  1) every dependency comes from crates.io, not straight from GitHub 2) the dependency list is tiny 3) it uses a cargo lock, so even if it were using a GitHub dependency, that file keeps a hash of the dependency and points at the specific commit, so if the dependency were to introduce a backdoor it wouldn't be automatically picked up and a commit history rewrite would also fail https://github.com/trifectatechfoundation/sudo-rs/blob/main/Cargo.lock https://github.com/trifectatechfoundation/sudo-rs/blob/main/...

FpUser 1y ago

>"But I'm aware that some people are frightened of new languages..." I am not frightened. I program in many languages and have no problems grasping Rust concepts. However I find Rust way too opinionated and restricting for personal tastes. For business I can not see myself replacing C++ with Rust unless my paying clients specifically request it. So far not a single one had expressed any interest.

drtgh 1y ago

This is not a new paradigm. It is a limitation in the design of the borrow checker, which causes you to go around until the borrowing takes on mainly a tree structure.