News for hackers. Stuff that matters.
Re:How Our Rust-to-Zig Rewrite Is Going by samatman on Thursday July 16, 2026 @06:11PM (#48940942)
Scenario A: A program has a memory vulnerability. That's bad, and the reason it's bad: attacker-controlled data can potentially trigger this vulnerability, which could even lead to privilege escalation.

Scenario B: A program writes machine code in an executable region of memory, and the code has a memory vulnerability. That's bad, and the reason it's bad: attacker-controlled data can potentially trigger this vulnerability, which could even lead to privilege escalation.

Scenario C: A program write machine code to disk, which is then read into memory and executed. That's bad, and the reason it's bad: attacker-controlled data can potentially trigger this vulnerability, which could even lead to privilege escalation.

Re:How Our Rust-to-Zig Rewrite Is Going by dwattttt on Thursday July 16, 2026 @11:36PM (#48943101)
Or scenario D:

A text editor stores a URL in a location on disk, and another component then fetches and executes that with its current privileges.

Re:How Our Rust-to-Zig Rewrite Is Going by fragmede on Friday July 17, 2026 @12:37AM (#48943381)
Or in this day and age, that component is an AI agent, and it executes with the things stored in its memory, and is abused into exfiltrating data.
Re:How Our Rust-to-Zig Rewrite Is Going by minraws on Friday July 17, 2026 @02:59AM (#48944155)
How is that a memory safety issue in Rust compiler? What point are we making here. Am I just too dense to understand, is how the hell is that a need unsafe issue? Or anything to do with compilers???
Re:How Our Rust-to-Zig Rewrite Is Going by jibal on Saturday July 18, 2026 @08:07AM (#48957343)
TFA discusses this in detail. The point is memory errors in the generated code. The generated code is an output the compiler. Thus the OP counts these against the compiler--after all, that's his project, those bugs are real, and those bug reports must be dealt with. His point is that the Rust borrow checker doesn't help at all with these bugs, and that matters when weighing the pros and cons of writing the compiler in Rust vs. Zig -- the languages are a wash for that category of error.

I do think this is a bit off, because miscompilations can produce all sorts of errors, not just memory errors, so it doesn't make much sense to categorize them as memory errors -- they are logic errors in the compiler. But the basic idea holds -- the choice of implementation language doesn't matter.