3 ms·

Whether you like Rust or not, it's questionable as to why Canonical would push this so much and do it in such a cavalier way. Will this really make coreutils m

Whether you like Rust or not, it's questionable as to why Canonical would push this so much and do it in such a cavalier way. Will this really make coreutils more secure? I doubt it, if anything there will be a river of new bugs. So, again, why are they pushing Rust so much? Having Microsoft make Rust a 'Tier-1' language also doesn't bode well.

pjmlp 11d ago
Canonical has been pushing its own agenda for ages, how many examples do you need? Microsoft making Rust tier 1 is great, it means probably one day we get a VS proper support instead of VSCode only. If you head off to Microsoft official blogs, you will find out that Microsoft already has tier 1 support for Java (ironically), Python and Go, besides the usual .NET languages and C++.
- torginus 11d ago
  Why does 'Ubuntu defaultism' still exist in the Linux world? Them replacing packages with shitty unworkable broken snap substitutes that can break the system when updating, and have a habit of reinstalling themselves...
  - pjmlp 10d ago
    Because of The Year of Linux Desktop and being the favoured distro among OEMs for their hardware.
  - tmtvl 10d ago
    They were for a long time the only big distro which made it easy to install non-free drivers.
pantalaimon 11d ago
It removes a GPLv3 dependency that might stop some companies from adopting Ubuntu Core.
- headsman771 11d ago
  Even more reason not to use it. Its clear that user freedom is under greater threat than it ever has been.
  - deleted 11d ago
    [deleted]
senfiaj 11d ago
>> Will this really make coreutils more secure? In the long run yes. Sure, many logic bugs happen in Rust programs as well, but memory safety bugs are another level of hell. At least many classes of exploits will mostly be impossible. Also, Rust program failures tend to be more predictable. For example, in C/C++, if you do out of bound writes in an array or writes in a freed memory block, the behavior is undefined. The program might crash, the memory might be silently corrupted, or nothing might happen at all. In a normal (non unsafe) Rust code these kinds of issues are either prevented by static checks or become explicit runtime panics. While the migration could be done more gradually, 26.10 is not an LTS release and is not considered stabe enough. The next LTS is 28.04, so I hope there is 1.5+ years for things to stabilize.
- aliceFish 11d ago
  new C++ STL standard makes it no more undefined.
  - senfiaj 11d ago
    In theory yes, but it requires enough discipline and knowledge. A language that makes it harder to write bad code still has an advantage over a language that doesn't care about bad code.
- rshackleford1 11d ago
  Can you point to any outstanding, unfixable, memory safety bugs in the coreutils that justify such a rewrite? This is a cynical license issue, not a safety issue. I think there are much more severe security risks which come from behavior divergence of replacement tooling than memory safety bugs from 40 year old widely used/tested software.
  - erminpour 11d ago
    Rusty Shackelford :D
  - DeathMetal3000 9d ago
    The software world is littered with memory vulnerabilities and you’re here still asking for proof? You may not like Rust and that’s fine. But don’t continue propagating the attitude that got us here in the first place.
monegator 11d ago
MIT License

pjmlp 11d ago

Canonical has been pushing its own agenda for ages, how many examples do you need? Microsoft making Rust tier 1 is great, it means probably one day we get a VS proper support instead of VSCode only. If you head off to Microsoft official blogs, you will find out that Microsoft already has tier 1 support for Java (ironically), Python and Go, besides the usual .NET languages and C++.

torginus 11d ago
Why does 'Ubuntu defaultism' still exist in the Linux world? Them replacing packages with shitty unworkable broken snap substitutes that can break the system when updating, and have a habit of reinstalling themselves...
- pjmlp 10d ago
  Because of The Year of Linux Desktop and being the favoured distro among OEMs for their hardware.
- tmtvl 10d ago
  They were for a long time the only big distro which made it easy to install non-free drivers.

pantalaimon 11d ago

It removes a GPLv3 dependency that might stop some companies from adopting Ubuntu Core.

headsman771 11d ago
Even more reason not to use it. Its clear that user freedom is under greater threat than it ever has been.
- deleted 11d ago
  [deleted]

senfiaj 11d ago

>> Will this really make coreutils more secure? In the long run yes. Sure, many logic bugs happen in Rust programs as well, but memory safety bugs are another level of hell. At least many classes of exploits will mostly be impossible. Also, Rust program failures tend to be more predictable. For example, in C/C++, if you do out of bound writes in an array or writes in a freed memory block, the behavior is undefined. The program might crash, the memory might be silently corrupted, or nothing might happen at all. In a normal (non unsafe) Rust code these kinds of issues are either prevented by static checks or become explicit runtime panics. While the migration could be done more gradually, 26.10 is not an LTS release and is not considered stabe enough. The next LTS is 28.04, so I hope there is 1.5+ years for things to stabilize.

aliceFish 11d ago
new C++ STL standard makes it no more undefined.
- senfiaj 11d ago
  In theory yes, but it requires enough discipline and knowledge. A language that makes it harder to write bad code still has an advantage over a language that doesn't care about bad code.
rshackleford1 11d ago
Can you point to any outstanding, unfixable, memory safety bugs in the coreutils that justify such a rewrite? This is a cynical license issue, not a safety issue. I think there are much more severe security risks which come from behavior divergence of replacement tooling than memory safety bugs from 40 year old widely used/tested software.
- erminpour 11d ago
  Rusty Shackelford :D
- DeathMetal3000 9d ago
  The software world is littered with memory vulnerabilities and you’re here still asking for proof? You may not like Rust and that’s fine. But don’t continue propagating the attitude that got us here in the first place.

monegator 11d ago

MIT License