3 ms·
Interesting. Though it reminds me of Alexis's "Parse, don't validate", isn't `syscall :: u8 -> Untrusted<u8>` considered as "validate"? I hope kernel codes th
by lock1 1y ago
Interesting.
Though it reminds me of Alexis's "Parse, don't validate", isn't `syscall :: u8 -> Untrusted<u8>` considered as "validate"?
I hope kernel codes that consume it will transform it to appropriate type as well `Untrusted<u8> -> T`.
- vlovich123 1y agoThe kernel is different because it’s not safe to access Untrusted until you copy it locally. Only then can you start parsing. Otherwise you run the risk of TOCTOU security vulnerabilities parsing user space input which then changes the next time you try to access it. Untrusted doesn’t validate - it just ensures you don’t accidentally access the data until you’ve ingested data that could be potentially attacking you.