Librsvg now requires Rust • Hacker News Board

Re: Librsvg now requires Rust

#21

Post by jasonm23 » Thu, Jan 05, 2017, 12:18 AM UTC

flukus wrote: post #18

BuuQu9hu wrote: post #15

Not sure it is a good idea to depend on a language with only one implementation.

I could see that being a concern for a commercial product. but why is it a concern for an open source one?

https://www.w3.org/TR/webdatabase/

Re: Librsvg now requires Rust

#22

Post by flukus » Thu, Jan 05, 2017, 12:25 AM UTC

jasonm23 wrote: post #21

flukus wrote: post #18

Earlier quoted context omitted.

I could see that being a concern for a commercial product. but why is it a concern for an open source one?

https://www.w3.org/TR/webdatabase/

That's a completely different situation.

Re: Librsvg now requires Rust

#23

Post by BuuQu9hu » Thu, Jan 05, 2017, 1:23 AM UTC

adamnemecek wrote: post #16

BuuQu9hu wrote: post #15

Not sure it is a good idea to depend on a language with only one implementation.

Why?

http://www.dwheeler.com/trusting-trust/

Re: Librsvg now requires Rust

#24

Post by flukus » Thu, Jan 05, 2017, 1:34 AM UTC

An informative post from Reddit: https://www.reddit.com/r/linux/comments/5m1vyv/slug/dc0dbu9

Librsvg wasn't maintained for years. We've received a huge amount of security bugs related to librsvg. Easily 10+ within a short timeframe. These weren't fixed because nobody was interested. The code itself is old and far from nice (from what I heard).

Federico volunteered to fix a few of these security bugs. This only resulted in people sending us even more security bugs. That required more time than Federico had. So again politely requesting for more assistance. Etc etc

Eventually Federico starts blogging about Rust, fixing super old but very visible bugs, etc. If you look at the announcement you'll notice how big just this one release is. He did way more.

Wikipedia relies on librsvg. The bugs were really hurting them. At one point it really seemed like maybe we'd better have a developer paid somehow to work on it.

tldr: great effort by Federico.

Re: Librsvg now requires Rust

#25

Post by muizelaar » Thu, Jan 05, 2017, 3:46 AM UTC

BuuQu9hu wrote: post #15

Not sure it is a good idea to depend on a language with only one implementation.

https://github.com/thepowersgang/mrustc is getting closer. Currently it can compile rustc through to failing codegen.

Re: Librsvg now requires Rust

#26

Post by db48x » Thu, Jan 05, 2017, 9:51 AM UTC

BuuQu9hu wrote: post #23

adamnemecek wrote: post #16

Earlier quoted context omitted.

Why?

http://www.dwheeler.com/trusting-trust/

The only sure way to beat that type of attack is to write your own compiler on your own hardware, not to rely on a different compiler that someone else wrote.

Re: Librsvg now requires Rust

#27

Post by db48x » Thu, Jan 05, 2017, 10:06 AM UTC

You might also be interested in Frederico's articles on the Rustification process: https://people.gnome.org/~federico/news.html

Re: Librsvg now requires Rust

#28

Post by BuuQu9hu » Fri, Jan 06, 2017, 4:31 AM UTC

db48x wrote: post #26

BuuQu9hu wrote: post #23

Earlier quoted context omitted.

http://www.dwheeler.com/trusting-trust/

The only sure way to beat that type of attack is to write your own compiler on your own hardware, not to rely on a different compiler that someone else wrote.

The linked paper disagrees.

Re: Librsvg now requires Rust

#29

Post by db48x » Sat, Jan 07, 2017, 3:09 PM UTC

BuuQu9hu wrote: post #28

db48x wrote: post #26

Earlier quoted context omitted.

The only sure way to beat that type of attack is to write your own compiler on your own hardware, not to rely on a different compiler that someone else wrote.

The linked paper disagrees.

Only if the second compiler is trusted. If I can hack one publicly available compiler, I can hack two; your second compiler should be private.