News for hackers. Stuff that matters.

A comment on Mitigating Memory Safety Issues in Open Source Software.

Re:Mitigating Memory Safety Issues in Open Source Software by tdimitrov on Thursday February 18, 2021 @08:28AM (#26179544)
Rust is a nice language for greenfield system software project. But everyone in the software industry knows that you can't just put a project on hold and rewrite completely in new language. I can't see anything good coming from this initiative.
[ Parent | on HN ]
Re:Mitigating Memory Safety Issues in Open Source Software by rkangel on Wednesday March 03, 2021 @08:31AM (#26328018)
Which is why the word 'incremental' is key here. They didn't rewrite the whole of cURL - they rewrote a key component.

Yes, ideally the whole program would be rewritten but security is not about absolutes. For a manageable amount of effort they have reduced the attack surface significantly.

[ Parent | on HN ]
Re:Mitigating Memory Safety Issues in Open Source Software by galgalesh on Thursday February 18, 2021 @02:09PM (#26184107)
Rust is designed to integrate into legacy codebases so security critical code can be rewritten in small steps. See the URL parser I Firefox. Moreover, the initiative this post is talking about uses rust to rewrite small parts of a C codebase.

Honestly, I'm getting more and more disappointed by the quality of discussion here on HN.

[ Parent | on HN ]
Re:Mitigating Memory Safety Issues in Open Source Software by tdimitrov on Friday February 19, 2021 @04:39AM (#26191241)
Thanks for the kind words :)

There is no such thing as security critical code. If it is out there - it can be expoloited. There are a lot of stories with minor exploit chaining leading to huge compromise.

[ Parent | on HN ]
Re:Mitigating Memory Safety Issues in Open Source Software by safercplusplus on Thursday February 18, 2021 @11:31AM (#26181876)
Some solutions aren't that well publicized. Here is an example of an open source png encoder/decoder written in C (mostly) being auto-translated to a memory-safe subset of C++:

https://github.com/duneroadrunner/SaferCPlusPlus-AutoTransla...

[ Parent | on HN ]
Re:Mitigating Memory Safety Issues in Open Source Software by cesarb on Thursday February 18, 2021 @12:00PM (#26182326)
Rust is a nice language for gradual rewrites too, especially when the original language was C. Some examples are Mercurial, librsvg, and Mozilla Firefox.
[ Parent | on HN ]