News for hackers. Stuff that matters.
Re:Deno 1.0 by rvz on Wednesday May 13, 2020 @06:50PM (#23172776)
A note on Deno and the safety of its V8 bindings:

> All of the V8 source code is distributed in the crate itself. Finally rusty_v8 attempts to be a safe interface. It's not yet 100% safe, but we're getting close. Being able to interact with a VM as complex as V8 in a safe way is quite amazing and has allowed us to discover many difficult bugs in Deno itself.

We'll also have to wait on who will be the first to have a production ready Javascript Engine written in Rust that could replace V8, if you're talking about safety.

Even with the "safe" bindings, you will still get the same C and C++ vulnerabilities found in V8 that will also be present in Deno.

Re:Deno 1.0 by ahupp on Wednesday May 13, 2020 @06:55PM (#23172816)
For this sort of problem Rust's safety guarantees don't buy you all that much. If you're generating machine code and implementing a GC that's not the sort of thing that Rust's typesystem can prove correct.

That said, a rust JS runtime would be amazing just because it's easier to integrate into rust projects.

Re:Deno 1.0 by klodolph on Wednesday May 13, 2020 @07:06PM (#23172913)
Well, sure, but a big chunk of the bugs in JRE were in the library, not the code generation or GC.
Re:Deno 1.0 by ahupp on Wednesday May 13, 2020 @07:17PM (#23173002)
Speaking of: Neon, a system for writing Node libraries in Rust is pretty cool:

https://neon-bindings.com/

Re:Deno 1.0 by jchw on Wednesday May 13, 2020 @07:26PM (#23173073)
Not sure exactly how much it buys you but I suspect there’s still room for research especially since Mozilla themselves has interest in a Rust JS JIT. I am curious to see if HolyJIT goes anywhere and what kinds of safety improvements it could potentially offer.
Re:Deno 1.0 by afiori on Wednesday May 13, 2020 @07:40PM (#23173218)
Deno plans to not expose V8 internals, unlike node. I do not know where the V8 vulnerabilities came from, but it should decrease the attack surface.