News for hackers. Stuff that matters.
Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by jmull on Monday July 19, 2021 @08:06AM (#27881678)
It’s the new bugs that didn’t exist in the original code that you need to be concerned about.

Consider any long-lived complex library. Count the bugs fixed since initial release. That’s your baseline — you can expect that order of magnitude of bugs in the initial release of your rewrite. Perhaps a new language will eliminate some classes of bugs, so maybe you can cut that number in half or even to a quarter. But you need to come to terms with that number. Now add on the number of bugs due to compatibility. Image formats generally are not tightly spec’ed, meaning the de facto standard libraries become the de facto standard — that is, the library being rewritten.

Rewrites are a long road that starts off one step forward and three steps back. It could sill be worth it, depending on the case. But an effort to “rewrite in rust” that doesn’t account for this will fail.

Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by roca on Monday July 19, 2021 @08:04PM (#27888686)
> That’s your baseline — you can expect that order of magnitude of bugs in the initial release of your rewrite.

My point was that the test suite you start with for your rewrite will be (or at least should be) a lot better than the test suite you had when you started writing the original code.

The spec will likely be better too. Also, you can learn a lot from the previous iteration.

These effects, plus the benefits of the new language, have the potential to reduce the bug count dramatically. Maybe even by an order of magnitude.

Having said that, you're certainly right that there are some steps back and the net cost or benefit is likely highly context-dependent.

It would be great to have more data on projects that have done this, to help people estimate the costs and benefits in their context.

Re:iOS 14.6 device hacked with a zero-click iMessage exploit... by zarzavat on Monday July 19, 2021 @09:34PM (#27889231)
Your cost benefit analysis is off. Which would you rather have, a broken jpeg once in a blue moon or a hacked phone?

Writing image decoders for several formats is hard but it's not so hard that a trillion dollar company can't write a good one.