Re:A distributed peer to peer list of bad actor IP addresses...
by riedel on Saturday February 05, 2022 @09:42AM
(#30221486)
Damn, do I have to shut down my wireguard VPN now? Memsafety is not everything. IMHO, everyone should write security relevant code in Ada Spark. There is reasons not to do it, I guess. At least now one can rewrite it in Rust an post it on HN...
Re:A distributed peer to peer list of bad actor IP addresses...
by mustache_kimono on Saturday February 05, 2022 @02:37PM
(#30224978)
Does Wireguard not do a privilege downgrade? That seems important. I know it needs some additional privileges, and therefore (right now?) will not run in a container (which is annoying), but after it has set up an interface, why doesn't it back off its privileges? I really want to try Wireguard but kept getting hung up on stuff like this.
Re:A distributed peer to peer list of bad actor IP addresses...
by mh7 on Saturday February 05, 2022 @10:27AM
(#30221986)
Neither rust or go have a formally verified compiler, they cannot be used for security critical programming.
Re:A distributed peer to peer list of bad actor IP addresses...
by gavinhenry on Saturday February 05, 2022 @11:08AM
(#30222426)
I had a lot of analysis paralysis over just this...in the end I chose what I chose for the reasons listed.
I think this is a poor choice (from a security perspective). It should be written in Go or rust. C programs (exposed to the network) are dangerous even when written by experienced developers.
Really, in 2022, everything Internet facing should be written in a memory safe language, running as a normal user (no root) and have a strong MAC policy applied. Anything else is too risky.