Ubuntu 26.10 completes transition to Rust-based coreutils

Re:Ubuntu 26.10 completes transition to Rust-based coreutils by perarneng on Monday September 14, 2026 @12:07PM (#49699250)

Better security, what's not to like. It's ridiculous to be against this in these times when we need all security we can get. So what if there is a minor incompatibility, can be fixe in no time. If we do a snapshot in time and count vounerabillities in the C codebase vs Rust im pretty sure who will have more in 5 years. It's just the nature of C codebases. C is a nice language but it was never designed with memory safety in mind. It was designed to be flexible and portable. It's a great language. Rust was designed to be fast and memory safe because it had 20+ years of C++ and C experience to learn from.

[ Parent | on HN ]

Re:Ubuntu 26.10 completes transition to Rust-based coreutils by stouset on Monday September 14, 2026 @12:33PM (#49699685)

There have been twelve CVEs reported against coreutils in the past twenty years.

There were forty-four against this project in just the last audit.

I am all for RIIR in cases where it makes sense. This does not even remotely appear to be one of them. By all appearances the quality of the code is extremely amateurish at best. coreutils has not been a significant source of vulnerabilities in the past, and they’re replacing it with code written by amateurs that performs worse and already has a worse security track record.

[ Parent | on HN ]

Re:Ubuntu 26.10 completes transition to Rust-based coreutils by Ygg2 on Monday September 14, 2026 @02:00PM (#49701147)

> There were forty-four against this project in just the last audit.

Was there an audit against coreutils? If not, it's not really apple-to-apple comparison.

[ Parent | on HN ]

Re:Ubuntu 26.10 completes transition to Rust-based coreutils by stouset on Monday September 14, 2026 @04:56PM (#49703886)

It doesn’t even matter. The sheer disparity in vulnerabilities over twenty years versus one year is impossible to hand-wave away.

We are talking about fourfold more CVEs over a twentyfold reduction in time.

[ Parent | on HN ]

Re:Ubuntu 26.10 completes transition to Rust-based coreutils by gpm on Monday September 14, 2026 @06:42PM (#49705246)

It really does matter. I don't know enough about this specific case, but multiple order of magnitude differences in CVE numbers are frequently explained by different policies towards finding and assigning CVEs in many many cases.

Absent more information the default should be to hand wave it away as probably such a difference. CVE counts are not a even slightly reliable metric.

[ Parent | on HN ]

Re:Ubuntu 26.10 completes transition to Rust-based coreutils by collinfunk on Monday September 14, 2026 @08:21PM (#49706095)

Most of them are TOCTOU races or improperly following symbolic links. For example, uutils mkfifo(1) would create a world-readable and writable FIFO before using chmod(2) to restrict its permissions. Another user could replace that file with a symbolic link between the mkfifo(3) call and the chmod(2) to change the permissions of arbitrary files [1].

Other ones I find concerning are that you could also bypass '-- no-preserve-root' with a symbolic link to root [2]. Or by using paths equivalent to "/", e.g., "/../" [3]. Historically, GNU coreutils has been pretty good with symbolic links and avoiding TOCTOU races. The only notable one I can remember is a chmod(1) bug [4].

I agree with your general point that the number of CVEs is a useless metric, though.

[1] https://nvd.nist.gov/vuln/detail/cve-2026-35352 [2] https://nvd.nist.gov/vuln/detail/cve-2026-35349 [3] https://nvd.nist.gov/vuln/detail/cve-2026-35338 [4] https://github.com/coreutils/coreutils/commit/425b8a2f534fe0...

[ Parent | on HN ]