181–190 of 408 posts
Earlier quoted context omitted.
Quoted post unavailable.
This tracks with your comment history https://news.ycombinator.com/item?id=567736
Earlier quoted context omitted.
Memory safety is optional in Rust. It might not be obvious at the moment, because Rust is written by enthusiasts who enjoy fighting with the compiler until their code compiles, but once developers will be forced to use it on their jobs with tight deadlines, unsafe becomes the pass-the-borrow-checker cheat code.
I write Rust at $WORK. Using `unsafe` to meet a deadline makes 0 sense. It doesn't disable the borrow checker unless you're literally casting references through raw pointers to strip lifetimes, which is... insane and would never pass a code review. 99% of the time if you're fighting the borrow checker and just want a quick solution, that solution is `clone` or `Arc >`, not `unsafe`. Those solutions will sacrifice per…
I've seen unsound unchecked casts from &UnsafeCell or *mut to &mut in multiple codebases, including Firefox itself: https://github.com/emu-rs/snes-apu/blob/13c1752c0a9d43a32d05..., https://searchfox.org/mozilla-central/rev/7142c947c285e4fe4f....
Why aren't these used to steal cryptocurrencies? According to the article you can buy a similar exploit for just $1-2.5 million. Considering the amount of money floating around that space, that it hasn't happened yet is surprising to me (or maybe I just don't pay attention to people who own crypto and are public about it, maybe they do get hit by zero-days all the time?).
"no way to stop them" = the economic impact to Apple isn't big enough to justify the engineering / rewrites required to completely prevent them.
It's baffling that they won't at least disable previews for senders not in your contacts. Ideally they would provide a way to block certain types of senders outright. I will NEVER want to receive an iMessage from an unknown email address, but that's where all of the spam crap comes from. Recently I was on my phone when I received an email address iMessage and the toast showed an absolutely insane link, when I opened…
Earlier quoted context omitted.
There's no silver bullet. Pledge on a complex application that does too many things [requests too many permissions] doesn't help much. IMO complexity and churn remain the biggest problems but people are not willing to engage it. There's always at least one legitimate use case for some faddy trendy new feature, always a reason for more complexity, fuck anyone who doesn't want it. And so you get a massive body of const…
>Pledge on a complex application I think you never saw how pledge works. SeLinux is complex. Pledge can be a piece of cake.
Earlier quoted context omitted.
I used Qubes as a daily driver for much of 2021. It hogged too much ram so I stopped. Never disliked the lack of non-ascii support. Security is always more important.
> Never disliked the lack of non-ascii support. Ah, the elusive quadruple-negative.
Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…
Nothing wrong with Rust, but I still think making operating systems with airtight sandboxing and proper permission enforcement is the only thing that can truly solve these issues.
I have a Galaxy Tab 3 which was on sale in my area until 2018. It's a perfectly usable device. Samsung refuses to upgrade past Android 7. The last security patch is more than a year old. Mobile security is a huge mess because of planned obsolescence. There should exist no security reasons that force me to junk a device faster than 10 years if the manufacturer is still in business. Regulatory action is required, that…
Earlier quoted context omitted.
Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust is cool because it’s got a solid-if-slow build story that doesn’t really buy into the otherwise ubiquitous .so brain damage. Rust is cool because H…
Do you imagine how long it would take to compile the Linux kernel if it were rust only? Not to mention the kernel has to allow for third party closed source stuff like drivers, wouldn't that force you to allow unsafe Rust and put you back to square one?