3 ms·

today it's "contained enough", tomorrow it's "huge as hell". Code grows, complexity increases. Servo use C++ libraries, so it's far from safe code. Try to use

today it's "contained enough", tomorrow it's "huge as hell". Code grows, complexity increases. Servo use C++ libraries, so it's far from safe code. Try to use Servo - you will see failures in first minute, I've tried.

bjwbell 12y ago
Failures don't mean unsafe. If you could exploit those failures that would mean unsafe. Try it on servo! Me & other servo contributors would welcome it.
- EugeneOZ 12y ago
  Don't be so aggressive. If I criticize code, it doesn't mean I criticize people. I tried to say that language injections (such as C++ libs) make Rust apps more fragile. If my assumption is wrong, and all these failures because of Rust code - I apologize.
  - bjwbell 12y ago
    I don't know with regards to the failures you saw. For the issues I see & fix most are in rust code. I didn't mean to sound aggressive, we really would welcome reports of safety issues. It's hard to know if servo /really/ is safer without the hundreds of people trying to exploit it that chrome & firefox have. Servo should be safer & I believe it's safer but I don't /know/ it's safer.
    - kibwen 12y ago
      The only way to know if it's safer is to keep working on it and wait for the CVEs to roll in. :)
kibwen 12y ago
You have to distinguish between the failures that are the result of unhandled logical errors ("panics", in Rust terminology), which are memory safe, and segmentation faults. Which are you seeing? If it's the latter, then I'm sure the Servo team would love a bug report at https://github.com/servo/servo/issues https://github.com/servo/servo/issues . As for the usage of C++ libraries, this will diminish over time. The history of Servo thus far has included a gradual process of rewriting C++-based components in Rust, and sometime this year Mozilla intends to begin rewriting small components of Firefox in Rust. Reducing the attack surface is always valuable.
- deleted 12y ago
  [deleted]

bjwbell 12y ago

Failures don't mean unsafe. If you could exploit those failures that would mean unsafe. Try it on servo! Me & other servo contributors would welcome it.

EugeneOZ 12y ago
Don't be so aggressive. If I criticize code, it doesn't mean I criticize people. I tried to say that language injections (such as C++ libs) make Rust apps more fragile. If my assumption is wrong, and all these failures because of Rust code - I apologize.
- bjwbell 12y ago
  I don't know with regards to the failures you saw. For the issues I see & fix most are in rust code. I didn't mean to sound aggressive, we really would welcome reports of safety issues. It's hard to know if servo /really/ is safer without the hundreds of people trying to exploit it that chrome & firefox have. Servo should be safer & I believe it's safer but I don't /know/ it's safer.
  - kibwen 12y ago
    The only way to know if it's safer is to keep working on it and wait for the CVEs to roll in. :)

kibwen 12y ago

You have to distinguish between the failures that are the result of unhandled logical errors ("panics", in Rust terminology), which are memory safe, and segmentation faults. Which are you seeing? If it's the latter, then I'm sure the Servo team would love a bug report at https://github.com/servo/servo/issues https://github.com/servo/servo/issues . As for the usage of C++ libraries, this will diminish over time. The history of Servo thus far has included a gradual process of rewriting C++-based components in Rust, and sometime this year Mozilla intends to begin rewriting small components of Firefox in Rust. Reducing the attack surface is always valuable.

deleted 12y ago
[deleted]