Re: Integrating "safe" languages into OpenBSD? (2017)

Post by saagarjha » Sun, May 03, 2020, 9:45 PM UTC

ddevault wrote: post #137

bsdubernerd wrote: post #103

It also doesn't help that Rust keeps on pushing on the idea that "static linking is the only way to go". This is another cargo-cult which I wish didn't end up being engrained so deep in the toolchain because while it has some merits, it also has significant drawbacks of a typical unix distribution. Static linking might be good for folks distributing a single server binary over a fleet of machines (pretty much like Go…

How much do your programs really share? After libc, libm, and pthreads, the most common thing they link to is probably pcre, and I'm sure you can guess how many of your programs are using that. A good linker will shave off the parts of a library you're not using, and the parts which are left over are usually not very big. The problem isn't with static linking, it's that some "developers" think that bundling an entire…

Post by saagarjha » Sun, May 03, 2020, 9:53 PM UTC

dathinab wrote: post #74

cycloptic wrote: post #59

Earlier quoted context omitted.

There is no gatekeeping. To actually achieve POSIX-compliance is not an easy task and requires lots of testing. If you don't do it then your replacement will break everyone's scripts. A distro maintainer will also want to retain compatibility with their supported GNU/BSD extensions so that's more work to add on. I would still agree with his statement at least as far as BSD is concerned. Outside of Redox I haven't see…

I don't think you miss anything. POSIX compliance is a headache which is not only hard to get right but also strongly limits your interfaces and internal tooling. Many scripts still will run with non full compliance, but that doesn't help if you try to build for OpenBSD. Also I'm not sure how they ended up with 400 deps for coreutils. I would have expected much less. But yes this means at least until better code sign…

Post by saagarjha » Sun, May 03, 2020, 9:59 PM UTC

qznc wrote: post #199

empath75 wrote: post #32

Earlier quoted context omitted.

I don’t think Linux or bsd will ever be rewritten in rust nor should they. I do think eventually there will be an os written in rust that surpasses them in popularity, but probably on the time frame of decades.

There are not many CVEs for coreutils anyways: https://www.cvedetails.com/product/5075/GNU-Coreutils.html?v... To improve security, Rust should probably aim to replace libjpeg and other stuff which deals with malicious data a lot.

Post by t0astbread » Sun, May 03, 2020, 10:08 PM UTC

Post by burntsushi » Sun, May 03, 2020, 10:18 PM UTC

damnyou wrote: post #203

hedora wrote: post #155

Earlier quoted context omitted.

You can check that the source hasn’t been tampered with before starting the build, and know you’re building the right code base. Builds that curl junk and use a dozen language specific package managers don’t have that property.

That is exactly the set of properties you get with Rust and Cargo: that the source hasn't been tampered with, and that you know you're building the right codebase. It would be deeply irresponsible to build a package management system without those properties.