• TheTechnician27@lemmy.world
    link
    fedilink
    English
    arrow-up
    24
    arrow-down
    5
    ·
    edit-2
    21 hours ago

    I mean yes, I do, given safe Rust inherently fixes seemingly every exploit listed in this article:

    • RCE from integer overflow (not possible by default in Rust, CVSS 9.0)
    • RCE from a race condition (not possible in safe Rust, CVSS 9.0)
    • An exploit of a buffer copy
    • An out-of-bounds write leading to local privilege escalation
    • Using an uninitialized resource
    • TCP query stack buffer overflow leading to local privilege escalation

    I feel like it’s the 1960s and I’m being told “we get it, you like seatbelts”.

    • LaggyKar@programming.dev
      link
      fedilink
      arrow-up
      3
      ·
      59 minutes ago

      RCE from integer overflow (not possible by default in Rust

      It is possible. Rust will check for overflow and panic in debug builds, but will silently wrap integers in release builds.

    • hoshikarakitaridia@lemmy.world
      link
      fedilink
      arrow-up
      5
      arrow-down
      20
      ·
      21 hours ago

      Yeah because the way you said it is extremely dick-ish and sounds like someone trying to push their preferred language onto others.

      • TheTechnician27@lemmy.world
        link
        fedilink
        English
        arrow-up
        26
        arrow-down
        3
        ·
        edit-2
        21 hours ago

        > “sounds like someone trying to push their preferred language onto others.”

        > didn’t even name Rust in the first comment

        I literally only talked about Rust when someone else mentioned it, because I’m not specifically talking about Rust.

        Whereas yes, Rust is relevant to the Linux kernel for obvious reasons (matching C’s speed and being easily interoperable with it), I said “a modern language” because I’m talking generally about the use of old, unsafe languages and major exploits surrounding problems that modern languages fix cropping up every 5 seconds.

        I’m not going to police my own tone about what are clearly negligent engineering practices. SWE should be treated with the same level of scrutiny as other engineering fields when its poor, outdated practices are constantly causing accelerating worldwide damage.