News for hackers. Stuff that matters.
Re:XSV: A fast CSV command-line toolkit written in Rust by shawn on Saturday September 08, 2018 @08:45PM (#17943664)
This question reduces to "Why trust Tarsnap?"

Colin is a renowned security expert and it's known how he handles vulnerabilities: http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-...

After that incident, the probability goes way up that it won't happen again.

Trust credibility, not tools.

Also, Tarsnap has had a long-standing bug bounty program, which is another reason to trust it.

Re:XSV: A fast CSV command-line toolkit written in Rust by TheDong on Saturday September 08, 2018 @09:27PM (#17943788)
Why can't I trust credibility and tools?

I do trust tarsnap, but if Colin wrote tarsnap in safe rust, I'd trust it even more.

Similarly, I can trust a library or program is less likely to exhibit crashes and memory issues if it's written in rust, and that allows the developers to be less renowned security experts while still producing usable code.

Your argument that C programs can be trusted to be memory safe and contain minimal bugs IFF they're written by experts doesn't prove the point that language's are meaningless for gaining trust.

I trust a combination of credibility and tools. If someone tells me they ran a fuzzer over their http server, I'll trust it more than if they say they didn't. That's not credibility, that's tools.

Both credibility and tools have their place. This isn't some black and white issue like you're portraying it.

Re:XSV: A fast CSV command-line toolkit written in Rust by lifthrasiir on Saturday September 08, 2018 @09:37PM (#17943816)
> Also, Tarsnap has had a long-standing bug bounty program, which is another reason to trust it.

This is not necessarily a reason to trust Tarsnap. It is just an (rather weak) indication of the security-oriented process and nothing more. Probably you would want to say security track records (inferred from the bug bounty program), which would be a good reason to trust it.