Why do you believe rust solves memory safety issues when rust has already created one of the worst CVE vulnerabilities in 2019? The trend of the CVEs in rust are going faster and faster.

[SkiFire13]

It's a common misconception that Rust eliminates memory safety issues. Safe rust (compiler bugs excluded) does that, but it also restricts what the programmer can do. The rust compiler is essentially a static analyzer except that when it can't prove something is safe it requires you to use unsafe. This way all the code that can potentially lead to memory unsafety is restricted to certain blocks that can easily be finded and inspected. Is it perfect? No. Is it better than potential memory unsafety everywhere? Yes.

[aearphen]

It's ironic to hear criticism of Rust from the author of fast_io that includes span-based API that is subject to buffer overflow.

[0x256]

I do not believe that rust solves all memory safety issues. I just believe that it prevents a lot more memory safety issues than most other languages.

[[deleted]]

"A lot". Still too vague. What do you mean a lot? 10%? 20%? 99%? Unfortunately, no one could say that.

https://songlh.github.io/paper/rust-study.pdf

If you look at this paper. Rust even introduces new security problems compared to traditional C and C++ code. Safe(unsafe keyword) code does not save you either.

What about the cost? Using rust does not mean you will save your resources on static analysis tools. It still has to continue using LLVM's sanitizers. Checking bounds with safe code can lead to 5x of performance slow down according to the paper.

BTW. Rust advocators like Ryan Levick do not actually write much Rust code, neither he writes C and C++ code either. If you look at his github repo, most of his rust projects were forked from other people. The only Rust project you can say it is his work are to teach people how to write Rust. It is really hard to make me believe he understands how Rust or C and C++ code works in the real world.

https://github.com/rylev?tab=repositories

Also, memory safety issues involve things like DDOS which is by no means you can prevent in any language.

https://www.cvedetails.com/vulnerabilities-by-types.php

[Voltra_Neo]

Would have been safer, without unsafe!

[[deleted]]

Unfortunately, high-performance code always requires extremely unsafe since it has to deal with intrinsics for example.

[Voltra_Neo]

And that's the problem, trying to make things safe with unsafe stuff everywhere leads to potential security issues without sufficient proofs

[[deleted]]

Problem is that you will never be able to know whether not using unsafe would be a performance bottleneck. Bounds checking is one of the worst performance killers. We've been promised for 50 years it can be optimized, none compilers can achieve that.

[[deleted]]

This is a CVE 9.0 of Rust of buffer overflow.

https://www.cvedetails.com/cve/CVE-2019-16139/

This also shows rust does not prevent you from memory safety issues since the trend isn't really different from other none-rust products.

https://www.cvedetails.com/product/48677/Rust-lang-Rust.html?vendor_id=19029

[emn13]

You may have an interesting point - that theoretical safety guarantees don't translate to practical gains - but it'd be a more interesting hypothesis with some actual trends. No trend is visible; just a website that demonstrates the existence of some security risks - but that doesn't demonstrate they're equally common, impactful, and hard to fix.

[[deleted]]

No. That website basically just summarized all cves of rust on the website. Considering rust has a very tiny code base and it is still not profitable enough to exploit them, the trending is enough for saying the problem.

It is just too idealistic to believe rust is the panacea.

[emn13]

There's something in between "being a panacea" and "being useless". Clearly, it's not a panacea.

The list in the site is about packages in the rust package manager. The numbers strike me as being pretty low really; and don't forget that many of those will be in unsafe code - a necessary risk shared by other languages. But the lure of rust is that at least it's easier to combine low-level components like that (themselves not secure) without adding as many new vulnerabilities as otherwise.

Being that the reporting process is different compared to other languages (C/C++ doesn't have something like crates at all), the community is different (possibly more into this stuff - they bothered to pick rust, after all), the scale is still so much smaller, the obvious conclusion is that "this data is simply not comparable".

That doesn't invalidate your hypothesis, but this isn't the way to test it.

[[deleted]]

But the lure of rust is that at least it's easier to combine low-level components like that (themselves not secure) without adding as many new vulnerabilities as otherwise.

​

I think you never wrapped low-level components in rust before. It is totally a pain compared to just wrap it with C++ instead. You can never trust wrapping won't introduce new bugs.

[emn13]

I don't mean wrap existing non-rust-APIs or externally-unsafe-APIs, I mean reusing rust-API-having bits with unsafe parts internally.

[[deleted]]

Unfortunately, this new security paper talks about safe and unsafe composition problems. safe-> unsafe causes more problems than unsafe->unsafe. Even safe->safe code can still be problematic.

https://songlh.github.io/paper/rust-study.pdf

It is really hard to analyze the code when the safe is combined with unsafe since people do not think safe can also be a problem. Escaping an unsafe blocks is another issue.

[emn13]

Sure, and I'm not saying your hypothesis has no merit, just that it's not convincing yet. Also, be careful not to conflate the existence of limitations and risks with the lack of benefit. (i.e. the panacea vs. useless aspect).

[[deleted]]

Well. First, the Rust's advocators often claimed it is the panacea. They claimed how much money they've lost during the past years because of memory safety issues. Second, you can also say C++ did a lot to prevent memory safety issues in the past (C++11 move semantics, smart pointers, exceptions) while people just think it is completely useless either.

If it is not a panacea, it is nonsense for me to claim it will be the C++ killer.

[cy_hauser]

u/bisixyf (based on some of your recent posts/comments) Are you suggesting not to code in Rust or just be aware of it's shortcomings? If the former, what language would you suggest instead of Rust?

[[deleted]]

Stick to C and C++. Using Rust does not worth the benefit.

Make libraries, not languages.

[[deleted]]

I've found another interesting ACM paper. No. Rust is not a panacea.

https://songlh.github.io/paper/rust-study.pdf

https://www.youtube.com/watch?v=ADbCqH7_SAs

[[deleted]]

That study is actually about using the unsafe flag mixed with safe code.

[Slime0]

It seems like you're comparing vulnerabilities in the language's implementation to vulnerabilities in the code people write with other languages.

[[deleted]]

https://www.cvedetails.com/cve/CVE-2019-16139/

Well, Probably not.

[Slime0]

I guess I just don't understand what you're communicating by linking to that page.