News for hackers. Stuff that matters.

A comment on On Linux, 'less' can probably get you owned. Parent comment

Re:On Linux, 'less' can probably get you owned by jeffdavis on Monday November 24, 2014 @04:00AM (#8651548)
The problem described in this post is beyond just a buffer overrun. It's about pulling in huge numbers of libraries for a few conveniences.

Rust can't save you from that; pulling in libraries makes it way too easy to increase the surface area of your code by several orders of magnitude. Even assuming rust offers an order of magnitude better security than C/C++, it still can't keep up. Sure, it mitigates things a little, but only until the next whiz-bang library gets linked in (even if it's written in rust, it will have some flaws).

In other words, the security of a program is based on the absolute number of bugs in it; but a programming language can't do much more than reduce the ratio of bugs to program size.

The OS is in a much better position to address the problem.

[ Parent | on HN ]
Re:On Linux, 'less' can probably get you owned by jschwartzi on Monday November 24, 2014 @05:04AM (#8651697)
Even including a standard C/C++ library can contribute unknown bugs. I have a prototype system on which the software crashed about once every 3 days until I updated the C library.
[ Parent | on HN ]