21–30 of 80 posts
I don't think I've ever heard of a Congressman going to GitHub, poking around in some open source code, and then asking very cogent and relevant questions about it. This video is incredible if only because of that.
Probably an intern on his staff did the research.
I feel like this is blindly upvoted. The video is underwhelming, and doesn't come close to answering the question. That said, I'm very impressed by the congressman in the video, as it sounds like he knows what he's talking about. Wikipedia doesn't mention much about programming in his bio...
The title is misleading although technically correct. They did respond just not with anything more than a "we'll get back to you". I do like the basics of his questions "who is committing code to Libra" and "why are using nightly build of Rust". I get the feeling he is not happy with it given his mention of "not how we usually did releases in the DOD" and pointing out the non-US coder. It will be interesting to see t…
I don't want to knock Rep. Riggleman too hard, since knowing what Github is (let alone how to use it) puts him in the top one or two percent of Congress; but DoD is by no means a paragon of software development practice. It cares far too much about compliance for the sake of compliance and far too little about whether that compliance enables business objectives such as security or reliability. (And waivers are easy to obtain when compliance makes things better, but difficult when compliance makes things worse.)
This is a good question to ask, especially about the nightly builds from upstream. There have been NPM exploits targeted at crypto currency developers (e.g. the event-stream breach), so it seems FB would be placing a lot of trust in the Rust developers. This is not to say Rust maintainers are dishonest, but all it takes is one person who's authentication credentials gets comprised.
Congressman: I was really surprised about the Rust language. So my first question is, why was the Rust language chosen as the implementation language for Libra? Do you believe it's mature enough to handle the security challenges that will affect these large cryptocurrency transactions? Facebook: [We will own & control the code.] Congressman: It looks like Libra was built on the nightly build of the Rust programming l…
Earlier quoted context omitted.
Probably an intern on his staff did the research.
>Riggleman was in the Air Force for eleven years, serving as an intelligence officer. He then worked as a contractor for the National Security Agency. He may just be familiar with programming.
Congressman: I was really surprised about the Rust language. So my first question is, why was the Rust language chosen as the implementation language for Libra? Do you believe it's mature enough to handle the security challenges that will affect these large cryptocurrency transactions? Facebook: [We will own & control the code.] Congressman: It looks like Libra was built on the nightly build of the Rust programming l…
It's probably mostly just async/await, but I bet they were hoping it'd make it into stable before they launched.
From Reddit:
> The intention of that particular script is to eventually help us move towards eliminating the use of nightly features and limit depending on new ones so that we can eventually be on stable. Some features (like async/await) we'll need to wait until they've graduated to stable while others we should be able to make sufficient changes to stop relying on them.
Congressman: I was really surprised about the Rust language. So my first question is, why was the Rust language chosen as the implementation language for Libra? Do you believe it's mature enough to handle the security challenges that will affect these large cryptocurrency transactions? Facebook: [We will own & control the code.] Congressman: It looks like Libra was built on the nightly build of the Rust programming l…
I don't think I've ever heard of a Congressman going to GitHub, poking around in some open source code, and then asking very cogent and relevant questions about it. This video is incredible if only because of that.
Congresspeople often come from backgrounds other than law. It could have also been his aides helping with this.
This is a good question to ask, especially about the nightly builds from upstream. There have been NPM exploits targeted at crypto currency developers (e.g. the event-stream breach), so it seems FB would be placing a lot of trust in the Rust developers. This is not to say Rust maintainers are dishonest, but all it takes is one person who's authentication credentials gets comprised.
Wouldn't the same apply to practically any programming language and development tools? What if they'd chosen Microsoft Visual C++? Would that be less exploitable?
This is a good question to ask, especially about the nightly builds from upstream. There have been NPM exploits targeted at crypto currency developers (e.g. the event-stream breach), so it seems FB would be placing a lot of trust in the Rust developers. This is not to say Rust maintainers are dishonest, but all it takes is one person who's authentication credentials gets comprised.
Wouldn't the same apply to practically any programming language and development tools? What if they'd chosen Microsoft Visual C++? Would that be less exploitable?
More scrutiny goes into stable release builds than nightly builds, and more mature languages and tools have more experienced maintainers who are often (but of course, not always) better at scrutinizing releases. It’s not that MSVC++ can’t be compromised, but it’s pretty unlikely that it would be.