News for hackers. Stuff that matters.
Re:Eliminating Memory Safety Vulnerabilities at the Source by SkyMarshal on Wednesday September 25, 2024 @05:42PM (#41652181)
They talk about "memory safe languages (MSL)" plural, as if there is more than one, but only explicitly name Rust as the MSL they're transitioning to and improving interoperability with. They also mention Kotlin in the context of improving Rust<>Kotlin interop, which also has some memory-safe features but maybe not to same extent as Rust. Are those the only two Google uses, or are there others they could be referring to?
Re:Eliminating Memory Safety Vulnerabilities at the Source by steveklabnik on Wednesday September 25, 2024 @05:48PM (#41652208)
A few thoughts:

People who care about this issue, especially in the last few years, have been leaning into a "memory safe language" vs "non memory safe language" framing. This is because it gets at the root of the issue, which is safe by default vs not safe by default. It tries to avoid pointing fingers at, or giving recommendations for, particular languages, by instead putting the focus on the root cause.

In the specific case of Android, the subject of this post, I'm not aware of attempts to move into other MSLs than those. But I also don't follow Android development generally, but I do follow these posts pretty closely, and I don't remember any of them talking about stuff other than Rust or Kotlin.

Re:Eliminating Memory Safety Vulnerabilities at the Source by amluto on Wednesday September 25, 2024 @09:47PM (#41653704)
> I don't remember any of them talking about stuff other than Rust or Kotlin.

Don’t forget the old, boring one: Java.

I assume the reason that Go doesn’t show up so much is that most Android processes have their managed, GC’d Java-ish-virtual-machine world and their native C/C++ world. Kotlin fits in with the former and Rust fits in with the latter. Go is somewhat of its own thing.

Re:Eliminating Memory Safety Vulnerabilities at the Source by vvanders on Wednesday September 25, 2024 @10:15PM (#41653854)
Android has a surprising amount of core OS functionality in boring managed Java code. ART/Dalvik are quite impressive combined with a few other clever tricks to make a system that ran in a pretty small footprint.
Re:Eliminating Memory Safety Vulnerabilities at the Source by pjmlp on Friday September 27, 2024 @03:28AM (#41667341)
Including mixed mode JIT/AOT compilation with PGO feedback, which many still aren't aware of.
Re:Eliminating Memory Safety Vulnerabilities at the Source by pdimitar on Thursday September 26, 2024 @05:55AM (#41656467)
I would think one of the reasons that Golang is not utilized is its lack of tagged unions. Another might be that it has a runtime and a GC which is typically undesirable for systems (as in: very close to the metal) software.
Re:Eliminating Memory Safety Vulnerabilities at the Source by pjmlp on Thursday September 26, 2024 @08:47AM (#41657768)
Go doesn't have any role on Android, other than being used on a build system that uses Go as its DSL.
Re:Eliminating Memory Safety Vulnerabilities at the Source by alpire on Wednesday September 25, 2024 @05:53PM (#41652262)
Android talked more about the memory-safe languages they're using in a previous blog post: https://security.googleblog.com/2022/12/memory-safe-language...

Google also published their perspective on memory safety in https://security.googleblog.com/2024/03/secure-by-design-goo..., which also goes over some of the memory-safe languages in use like Java, Go and Rust.

Re:Eliminating Memory Safety Vulnerabilities at the Source by nightpool on Wednesday September 25, 2024 @06:37PM (#41652607)
It's not just Rust—rewriting a C network service into Java or Python or Go is also an example of transitioning to memory safe languages. The point is that you're not exposed to memory safety bugs in your own code. Arguably it's much better to choose a language without Rust-like manual memory management when you don't absolutely need it.
Re:Eliminating Memory Safety Vulnerabilities at the Source by pdimitar on Thursday September 26, 2024 @05:56AM (#41656477)
I have chosen Rust over Golang on a number of occasions for a much more boring reason: Golang lacks enums / tagged unions / sum types. When you have to manually eyeball your code to ensure exhaustiveness, it gets old and tiring really fast.

For that reason I'd use OCaml as well even though it has GC, because it has sum types. That is, if I ever learn OCaml properly.

Re:Eliminating Memory Safety Vulnerabilities at the Source by tialaramex on Thursday September 26, 2024 @02:15PM (#41661446)
If you need concurrency then depending on exactly what you're doing with it Rust still looks like the right choice. If you can just have it magically work no worries, but the moment you need synchronization primitives or phrases like "thread safe" come into the conversation you're much more likely to get it wrong in the other languages.
Re:Eliminating Memory Safety Vulnerabilities at the Source by jnwatson on Wednesday September 25, 2024 @06:19PM (#41652472)
Java and Kotlin are used for apps. Rust is used for new system software.

Across Google, Go is used for some system software, but I haven't seen it used in Android.

Re:Eliminating Memory Safety Vulnerabilities at the Source by GeekyBear on Thursday September 26, 2024 @02:32PM (#41661621)
Google attempted to write a network stack in Go for their Fuchsia OS, but it had to be ripped out and rewritten for performance reasons.

https://news.ycombinator.com/item?id=22409838

Re:Eliminating Memory Safety Vulnerabilities at the Source by dgacmu on Wednesday September 25, 2024 @05:53PM (#41652265)
There are many and google uses several - rust, python, java, and go among them. But low-level code for Android has historically been in c++ and Rust is the primary memory-safe replacement for the stuff they're building.
Re:Eliminating Memory Safety Vulnerabilities at the Source by NoahKAndrews on Wednesday September 25, 2024 @09:46PM (#41653698)
Kotlin is memory-safe. It runs with a GC.
Re:Eliminating Memory Safety Vulnerabilities at the Source by adgjlsfhk1 on Wednesday September 25, 2024 @11:39PM (#41654321)
GC is memory-safe.
Re:Eliminating Memory Safety Vulnerabilities at the Source by saagarjha on Thursday September 26, 2024 @12:20AM (#41654523)
That's what they said.
Re:Eliminating Memory Safety Vulnerabilities at the Source by adgjlsfhk1 on Thursday September 26, 2024 @12:21AM (#41654529)
I can't read. oops.
Re:Eliminating Memory Safety Vulnerabilities at the Source by wmf on Wednesday September 25, 2024 @09:59PM (#41653759)
Google has always tried to use a small set of languages. For Android they try to use C/C++, Java/Kotlin, and now Rust. The same lessons still apply in rampantly polyglot environments though.
Re:Eliminating Memory Safety Vulnerabilities at the Source by jeffbee on Wednesday September 25, 2024 @10:15PM (#41653855)
Perhaps they are even considering carbon to be memory safe
Re:Eliminating Memory Safety Vulnerabilities at the Source by _ph_ on Thursday September 26, 2024 @03:00AM (#41655317)
That is the separation between abstract considerations and a given projects constraints. In a given project there might be few choices, but if you talk about fundamental phenomena, you have to reason about arbitrary projects. And of course, there are plenty of alternatives to Rust. Even limited to Android, there are several choices, even if they might be a smaller set.
Re:Eliminating Memory Safety Vulnerabilities at the Source by pdimitar on Thursday September 26, 2024 @05:59AM (#41656497)
It's impractical to increase the surface of complexity even further. I for one approve that they settled on just one memory-safe language for their new code.
Re:Eliminating Memory Safety Vulnerabilities at the Source by _ph_ on Sunday September 29, 2024 @07:02AM (#41686513)
Oh sure, for the Linux kernel, Rust makes a lot of sense and one would try to keep the number of languages used minimal. But I was speaking about an abstract context. There are plenty of memory safe languages which could be used. But eventually, one has to decide for one.
Re:Eliminating Memory Safety Vulnerabilities at the Source by throwaway2037 on Thursday September 26, 2024 @11:05AM (#41659236)

    > memory safe languages
I would say anything that runs on JVM and CLR, and scripting langs, like Python, Perl, Ruby, etc.

Edit: I forgot Golang!

Re:Eliminating Memory Safety Vulnerabilities at the Source by GeekyBear on Thursday September 26, 2024 @12:13PM (#41660149)
There are many memory safe languages, but not many of those are compiled and able to offer performance that is in the same ballpark as C.

Rust and Swift are the two most widely used.

Interestingly, Swift had interoperating with C as an explicit design goal, while Rust had data race safety as a design goal.

Now we have data race safety added in the latest version of Swift, and Rust looking to improve interoperability with C.

Re:Eliminating Memory Safety Vulnerabilities at the Source by Narishma on Friday September 27, 2024 @02:24AM (#41666918)
I was under the impression that Swift was more in the Go/C# bucket rather than Rust/C++ in terms of performance.
Re:Eliminating Memory Safety Vulnerabilities at the Source by pjmlp on Friday September 27, 2024 @03:32AM (#41667363)
Swift's long term roadmap is to be usable in all scenarios Apple currently uses C, Objective-C and C++ for, it is even on its official documentation and product description site.

How much it gets there, depends on squizzing juice out of LLVM backend for Swift code.

Re:Eliminating Memory Safety Vulnerabilities at the Source by GeekyBear on Friday September 27, 2024 @01:09PM (#41673048)
Given that the person who created LLVM also created Swift, the ability to be used as a systems programming language was always there.

Chris Lattner, the creator of both LLVM and Swift, has referred to Swift as “syntactic sugar for LLVM.” They are deeply tied together.

The amount of Swift code in Apple's operating systems has increased every year.

https://blog.timac.org/2023/1019-state-of-swift-and-swiftui-...

Lattner gave an interview looking at the advantages of reference counting over the sort of garbage collection used in languages like Java, C#, and Go while still avoiding error-prone manual memory management.

> ARC has clear advantages in terms of allowing Swift to scale down to systems that can’t tolerate having a garbage collector, for example, if you want to write firmware in Swift. I think that it does provide a better programming model where programmers think just a little bit about memory.

https://atp.fm/205-chris-lattner-interview-transcript#gc

Re:Eliminating Memory Safety Vulnerabilities at the Source by GeekyBear on Friday September 27, 2024 @01:48PM (#41673548)
Reference counting doesn't have the same cost as a sweeping garbage collector.

Apple has also optimized their custom ARM core to further reduce the cost.

> retaining and releasing an NSObject takes ~30 nanoseconds on current gen Intel, and ~6.5 nanoseconds on an M1

https://blog.metaobject.com/2020/11/m1-memory-and-performanc...

That said, Swift is working toward adding a future opt-in Rust inspired approache to memory management for those who need it.

https://forums.swift.org/t/manifesto-ownership/5212

https://forums.swift.org/t/a-roadmap-for-improving-swift-per...