uecker

10 ms·

151.
by uecker 3mo ago
I assume he means multi-dimensional arrays: std::array<std::array<int, 3>, 5> array_of_ints; int c_style_array[5][3]; But the C-style array is more readable, so I am not sure what the complaint really is about.
152.
by uecker 3mo ago
I think we agree on this. Fil-C does not ensure this. Showing the absence of run-time errors at compile-time is a hard problem, and the most realistic solution in general is via model checkers which I think would be the ideal solution, but
153.
by uecker 3mo ago
It certainly works in my C programs. And Fil-C demos imply that this also works for a lot of other complex real world programs, i.e. a basic Linux distribution with libreoffice on top... So yes, I would say this just works. I agree that c
154.
by uecker 3mo ago
Of course, I just wished enough Rust enthusiast cared also about other real-word security issues enough to get this fixed: https://rustup.rs/
155.
by uecker 3mo ago
Regarding the silly point: Fil-C is less of a rock than Safe Rust as everything in C just works. I am not sure about what you mean by "aborts regularly". After a memory safety issue, I think one usually wants to abort quickly and
156.
by uecker 3mo ago
And 99% of the problem for memory safety and also any other issue goes away for the regular user if software is obtained from trusted sources that provide security support, because the window of opportunity for the attacker gets smaller. An
157.
by uecker 3mo ago
The percentage of fixed CVE at Microsoft is an irrelevant number. It is heavily biased by 1) what gets assigned a CVE in the first place (a usability issue or a weak supply chain usually does not even though far more relevant for users), 2)
158.
by uecker 3mo ago
> C (where the safe subset is effectively empty), Well, Fil-C and also Cheri show that C is a language that can be implemented with perfect memory safety for 99.9% of the language. This is not true for every language but is also not an a
159.
by uecker 3mo ago
Most people I know that had security incidents did not have this because of memory safety issues. But it does not matter, even without memory safety issues out of the picture, you would need to update your software and be wary of supply cha
160.
by uecker 3mo ago
You can also simply wrap an int in a struct in C.
161.
by uecker 3mo ago
Splitting programs into mutually untrusting modules is a plausible alternative to memory safety in programming languages. Also in a program similar to qmail, memory safety alone is not sufficient, a lot of bugs in sendmail were related to c
162.
by uecker 3mo ago
This is wrong as there are many other safety issues to worry about.
163.
by uecker 3mo ago
As a user you should be far more worried about running up-to-date software and supply chain risks rather than zero-days related to memory safety.
164.
by uecker 3mo ago
If we can all agree that my statement was true, there is no problem.
165.
by uecker 3mo ago
If you agree with that Rust sometimes has to add dynamic bounds check, then you could have just agreed with my original comment.
166.
by uecker 3mo ago
Rust does not do prevent all UB statically. Even if you guarantee at compile-time that all execution paths have well-defined semantics because compiler inserted run-time checks, this is not the same thing as "statically ensuring the a
167.
by uecker 3mo ago
I like using C. It is simple, elegant, has very fast compilation times, requires no FFI needed for many libraries, is extremely stable and extremely portable, a large ecosystem, and, most importantly, I do not think the ergonomics of C are
168.
by uecker 3mo ago
A: "Rust prefers to prevent all undefined behavior statically" me: It does dynamic bounds checking. Rustaceans: But... for XYZ ... it doesn't... Sigh.
169.
by uecker 3mo ago
Rust fails to prove basic indirection to be statically safe and instead does a run-time check. fn main() { let v = vec![1, 2, 3]; v[5]; }
170.
by uecker 3mo ago
Maybe? I think my statement is clearly correct in the way I formulated it.
171.
by uecker 3mo ago
He claims the system provides memory safety under data races. Does it not?
172.
by uecker 3mo ago
I read "Rust prefers to prevent all undefined behavior statically," to also imply that it actually does this, because otherwise the word "all" would not make sense to me in this sentence. Dependently types languages and
173.
by uecker 3mo ago
I merely pointed out that the statement "Rust prefers to prevent all undefined behavior statically" is misleading in the sense that Rust does not do this for all undefined behavior.
174.
by uecker 3mo ago
Rust can not do this. But the original claim is that it is all statically checked in Rust, and this is an obvious counter example. Some dependently types languages can prove this statically, also model checking can do this, etc. So it can
175.
by uecker 3mo ago
These are not terribly interesting cases though, as it would also be impossible to get an oob access in other languages either.
176.
by uecker 3mo ago
Arguably the most important memory safety property, i.e. bounds checking for dynamic arrays, is also not statically checked in Rust.
177.
by uecker 3mo ago
Via remote attestation.
178.
by uecker 3mo ago
The website / service you want to use will not accept your key, but only the key from the organization that makes sure that your software does not make it possible to skip the ads. So I think the only chance to avoid this is to reject
179.
by uecker 3mo ago
Rust as a language is not relevant, but the Rust community still helped to popularize the idea that trashing a community by a rewrite is ok if it serves some "higher goal". This rewrite is just a striking example why this is probl
180.
by uecker 3mo ago
I assume it is meant to not only have hashes of the final output, but also securely record all steps done by the right people and the right inputs during building of the software. But this solves the wrong^1 problems while still leaving th

More ›