News for hackers. Stuff that matters.
Re:New Linux glibc flaw lets attackers get root on major dis... by foobiekr on Sunday February 04, 2024 @02:04PM (#39253258)
There's a kind of naive thing going on on HN where peopel see a bug and ask whether or assert Rust will fix it. The problem is they are homing in on just the bugs Rust addresses - this is fine, I've had this conversation at work (not involving Rust, even) for two decades, including discussions about Java.

The problem is that Rust solves _a_ class of issues without even beginning to address other kinds of problems, and so this sort of thinking is evolving toward a mindset that "oh it's rust so no security issues", which is completely wrong.

Re:New Linux glibc flaw lets attackers get root on major dis... by eichin on Sunday February 04, 2024 @02:16PM (#39253397)
Perhaps an innoculation against this is to respond "Yes, but so would Ada"
Re:New Linux glibc flaw lets attackers get root on major dis... by pjmlp on Sunday February 04, 2024 @03:44PM (#39254252)
I keep using "mostly safe languages" as kind of abstract term, Rust comes into speech even in scenarios where other alternatives would be a viable option.
Re:New Linux glibc flaw lets attackers get root on major dis... by foobiekr on Monday February 05, 2024 @10:55PM (#39270572)
Ada is such a lost opportunity honestly. As powerful as C, performant and clean.
Re:New Linux glibc flaw lets attackers get root on major dis... by pjmlp on Tuesday February 06, 2024 @07:22AM (#39273459)
Unfortunely did not come with an OS, wasn't freely available, and quite costly.

Remeber that until AT&T was allowed to take commercial advantage of UNIX, its source code was available for a symbolic price, and it came with a C compiler toolchain, at least until Sun started the trend among UNIX vendors of spliting UNIX development tools into an additional purchase.

The UNIX vendors that had Ada compilers, that was an additional purchase on top of UNIX SDK (which already had C and C++), so unless there was a hard requirement to use Ada, no one bothered to pay extra.

Re:New Linux glibc flaw lets attackers get root on major dis... by foobiekr on Tuesday February 06, 2024 @01:48PM (#39278666)
Indeed. Ada killed itself, partially because it was one of the DoD approved languages and so the vendors got on board with raping and pillaging everything they could, killing the whole thing in the process.
Re:New Linux glibc flaw lets attackers get root on major dis... by IshKebab on Sunday February 04, 2024 @05:24PM (#39255146)
I don't think so. Rust solve a class of security issue, but that class is 2/3 of all security issues! That's overwhelmingly more secure.

And it's not like it has no effect on the final third either. The stronger type system and ownership system make non-memory related bugs less likely too.

Your comment makes it sound as if you have a better solution. But Rust is the best one we know so far, so this kind of naysaying does more harm than good.

Re:New Linux glibc flaw lets attackers get root on major dis... by armitron on Sunday February 04, 2024 @08:43PM (#39256379)
Do you realize how many security issues exist in applications written in memory-safe Java/PHP/JS/Python ? Memory corruption is but the tip of the iceberg.
Re:New Linux glibc flaw lets attackers get root on major dis... by xcdzvyn on Monday February 05, 2024 @02:04AM (#39258172)
You are right that there are software bugs that aren't memory bugs.

Now as GP was saying, Rust inherently mitigates a great deal of generally serious software vulnerabilities, which is great, even if it doesn't mitigate anything else.

Re:New Linux glibc flaw lets attackers get root on major dis... by IshKebab on Monday February 05, 2024 @03:09AM (#39258512)
Memory corruption is literally 2/3 of the iceberg. Look it up.
Re:New Linux glibc flaw lets attackers get root on major dis... by GoblinSlayer on Monday February 05, 2024 @11:38AM (#39263144)
Naysaying is that these problems can't be fixed in C, this kind of naysaying does more harm than good. Rust merely uses an idea that was known before C even existed.