Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use • Hacker News Board

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#61

Post by HackerNCoder » Sun, Sep 04, 2022, 4:17 PM UTC

sai_svkv5 wrote: post #60

Is this purely rust? Or is there some C code dependencies? If yes, can you share the breakup of language composition in the codebase?

There is some C in the gitlab repo? https://gitlab.torproject.org/tpo/core/arti/-/graphs/main/ch...

But the CONTRIBUTING doesn't say you need to install a C compiler, so probably not? https://gitlab.torproject.org/tpo/core/arti/-/blob/main/CONT...

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#62

Post by mleonhard » Sun, Sep 04, 2022, 6:03 PM UTC

There are two instances of `unsafe` in Arti. Both are unnecessary.

1. A mmap'd file is checked to be UTF-8 and then assumed never to change on disk to become non-utf8. https://gitlab.torproject.org/tpo/core/arti/-/merge_requests...

2. A struct holds a raw pointer so it can report an offset into a string later. It should just store the offset. https://gitlab.torproject.org/tpo/core/arti/-/blob/main/crat...

The project has the option to use `tokio`, which contains a staggering amount of unsafe code. I hope nobody distributes prebuilt version of Arti that use tokio.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#63

Post by xcdzvyn » Sun, Sep 04, 2022, 11:23 PM UTC

HackerNCoder wrote: post #61

sai_svkv5 wrote: post #60

Is this purely rust? Or is there some C code dependencies? If yes, can you share the breakup of language composition in the codebase?

There is some C in the gitlab repo? https://gitlab.torproject.org/tpo/core/arti/-/graphs/main/ch... But the CONTRIBUTING doesn't say you need to install a C compiler, so probably not? https://gitlab.torproject.org/tpo/core/arti/-/blob/main/CONT...

Rust already depends on LLVM

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#64

Post by Narishma » Mon, Sep 05, 2022, 1:08 AM UTC

xcdzvyn wrote: post #63

HackerNCoder wrote: post #61

Earlier quoted context omitted.

There is some C in the gitlab repo? https://gitlab.torproject.org/tpo/core/arti/-/graphs/main/ch... But the CONTRIBUTING doesn't say you need to install a C compiler, so probably not? https://gitlab.torproject.org/tpo/core/arti/-/blob/main/CONT...

Rust already depends on LLVM

Does it depend on clang? Because LLVM can't compile C by itself.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#65

Post by moltonel3x » Mon, Sep 05, 2022, 3:09 PM UTC

HackerNCoder wrote: post #61

sai_svkv5 wrote: post #60

Is this purely rust? Or is there some C code dependencies? If yes, can you share the breakup of language composition in the codebase?

There is some C in the gitlab repo? https://gitlab.torproject.org/tpo/core/arti/-/graphs/main/ch... But the CONTRIBUTING doesn't say you need to install a C compiler, so probably not? https://gitlab.torproject.org/tpo/core/arti/-/blob/main/CONT...

On single C file, 159 lines compared to 83000 lines of Rust. It's used to generate a cert for unittests, not sure why that's not done in Rust.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#66

Post by moltonel3x » Mon, Sep 05, 2022, 3:27 PM UTC

xcdzvyn wrote: post #63

HackerNCoder wrote: post #61

Earlier quoted context omitted.

There is some C in the gitlab repo? https://gitlab.torproject.org/tpo/core/arti/-/graphs/main/ch... But the CONTRIBUTING doesn't say you need to install a C compiler, so probably not? https://gitlab.torproject.org/tpo/core/arti/-/blob/main/CONT...

Rust already depends on LLVM

So ? The fact that rustc compiler uses a component written in C++ doesn't mean that even pure Rust projects have a C++ dependency. Follow any language's bootstrap chain and you'll find C somewhere (or a bootstrapping purists telling you that didn't properly bootstrap the thing), making the "some of the FOOLANG compiler is written in BARLANG" argument pointless.

You don't need a C or C++ compiler (not even Clang) to compile Arti. The rustc packages typically use a vendored version of LLVM.

Re: Tor – Arti 1.0.0 is released: Rust Tor implementation ready for production use

#67

Post by moltonel3x » Mon, Sep 05, 2022, 9:03 PM UTC

zxcvbn4038 wrote: post #34

Uptrenda wrote: post #19

To me this just seems pointless because an implementation in Rust is going to have similar features to one in C, Java, Python, or any of the handful of languages where Tor already exists... I want to rep another project that I think would be more relevant to Tor's goals. It is unfunded yet should it exist: would have the potential to transform privacy on the web. The project is https://github.com/Ayms/node-Tor It's a…

I don't think that Tor in javascript would improve anything. Tor in golang on the other hand would gain multithreading and ease of integration. It would drop in nicely with the Golang standard library.

A Go version wouldn't improve anything upon the Rust version either. At this scale, Go's simplicity would be a hindrance more than a help, development velocity would suffer compared to Rust. Integration would only be possible in the Go ecosystem, whereas Rust can expose a C API so that Arti can be used (eventually) as the engine for implementations in other languages (Go, Python, JS, etc). Multithreading and overall performance can be better optimized in Rust.

Tor is critical security software with a lot of implementation gotchas. Just like you shouldn't write your own crypto, you shouldn't write your own Tor. Arti is developed by contributors of the original C Tor, I wouldn't go near a Js/Go/whatever implementation from a team with less credentials.