Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Memory Safe Languages in Android 13

security.googleblog.com

Post reply on HN
Print view View original

11–20 of 606 posts

Re: Memory Safe Languages in Android 13

#11

Post by thesuperbigfrog »

wiseowise wrote: post #10
thesuperbigfrog wrote: post #5

"Migrating away from C/C++ is challenging, but we’re making progress. Rust use is growing in the Android platform, but that’s not the end of the story. To meet the goals of improving security, stability, and quality Android-wide, we need to be able to use Rust anywhere in the codebase that native code is required. We’re implementing userspace HALs in Rust. We’re adding support for Rust in Trusted Applications. We’ve…

Actually now is the time to learn C++. Amount of leverage and money C++ developers will be able to utilize is enormous, given how much critical code is written in it.

>> Actually now is the time to learn C++. Amount of leverage and money C++ developers will be able to utilize is enormous, given how much critical code is written in it.

The article states:

"We continue to invest in tools to improve the safety of our C/C++. ... Vulnerabilities found using these tools contributed both to prevention of vulnerabilities in new code as well as vulnerabilities found in old code that are included in the above evaluation."

"These are important tools, and critically important for our C/C++ code. However, these alone do not account for the large shift in vulnerabilities that we’re seeing, and other projects that have deployed these technologies have not seen a major shift in their vulnerability composition. We believe Android’s ongoing shift from memory-unsafe to memory-safe languages is a major factor."

"our Rust code is proving to be significantly safer than pure C/C++ implementations."

C++ is great if you do not have alternatives.

If you can use Rust instead of C / C++, you should because of the greater safety it offers with similar performance characteristics.

Re: Memory Safe Languages in Android 13

#12

Post by Kukumber »

Another failure for Kotlin Native, what a sad shitshow..

They were warned many years ago about ownership/concurrency/compile speed, they didn't listen at all

A vision alone doesn't matter, you need skilled engineers and a dedicated team who understand what "taste" for great things is

What could have been the Swift for android will end up just being the "java" alternative, i suspect they'll get rid of the JVM, or whatever the tech is, altogether and focus on Rust for whatever they plan next (maybe Fuschia), maybe there is still hope for Swift, we'll see

Re: Memory Safe Languages in Android 13

#13

Post by littlestymaar »

wiseowise wrote: post #10
thesuperbigfrog wrote: post #5

"Migrating away from C/C++ is challenging, but we’re making progress. Rust use is growing in the Android platform, but that’s not the end of the story. To meet the goals of improving security, stability, and quality Android-wide, we need to be able to use Rust anywhere in the codebase that native code is required. We’re implementing userspace HALs in Rust. We’re adding support for Rust in Trusted Applications. We’ve…

Actually now is the time to learn C++. Amount of leverage and money C++ developers will be able to utilize is enormous, given how much critical code is written in it.

I don't think it's worth the pain to learn C++ today. Of course, expert or just senior C++ developers have a bright future ahead (even though their domain will slowly becomes more niche every year), but for someone starting their career now, I doubt they'll reach the expert level before it has lost most of its relevance.

Re: Memory Safe Languages in Android 13

#14

Post by maeln »

thesuperbigfrog wrote: post #11
wiseowise wrote: post #10

Earlier quoted context omitted.

Actually now is the time to learn C++. Amount of leverage and money C++ developers will be able to utilize is enormous, given how much critical code is written in it.

>> Actually now is the time to learn C++. Amount of leverage and money C++ developers will be able to utilize is enormous, given how much critical code is written in it. The article states: "We continue to invest in tools to improve the safety of our C/C++. ... Vulnerabilities found using these tools contributed both to prevention of vulnerabilities in new code as well as vulnerabilities found in old code that are in…

I think he meant it in a way the same way that some people are still learning COBOL: a lot of critical, legacy code is written in C++ and cannot easily (or won't be for various reason) moved to another langage. Therefore, developer that can maintain a C++ codebase might become invaluable for some company.

Re: Memory Safe Languages in Android 13

#15

Post by cwyers »

thesuperbigfrog wrote: post #11
wiseowise wrote: post #10

Earlier quoted context omitted.

Actually now is the time to learn C++. Amount of leverage and money C++ developers will be able to utilize is enormous, given how much critical code is written in it.

>> Actually now is the time to learn C++. Amount of leverage and money C++ developers will be able to utilize is enormous, given how much critical code is written in it. The article states: "We continue to invest in tools to improve the safety of our C/C++. ... Vulnerabilities found using these tools contributed both to prevention of vulnerabilities in new code as well as vulnerabilities found in old code that are in…

I believe what the post you're replying to is implying is, there's a ton of C++ code in the world that isn't going to be ported to Rust, and someone is going to have to fix all of those bugs in C++ code already in the wild. So you can get paid to be that person.

Re: Memory Safe Languages in Android 13

#16

Post by synergy20 »

wiseowise wrote: post #10
thesuperbigfrog wrote: post #5

"Migrating away from C/C++ is challenging, but we’re making progress. Rust use is growing in the Android platform, but that’s not the end of the story. To meet the goals of improving security, stability, and quality Android-wide, we need to be able to use Rust anywhere in the codebase that native code is required. We’re implementing userspace HALs in Rust. We’re adding support for Rust in Trusted Applications. We’ve…

Actually now is the time to learn C++. Amount of leverage and money C++ developers will be able to utilize is enormous, given how much critical code is written in it.

I'm learning modern c++ these days, but I don't follow your 'money' logic here...

Re: Memory Safe Languages in Android 13

#17

Post by onei »

Not being aware of how vulnerabilities are detected and despite being a big fan of Rust, I wonder if there are other variables that drive down the ability to find bugs in the short term. If a researcher is only familiar with C and C++, is it possible that they're just ill equipped to find similar bugs in Rust?

Re: Memory Safe Languages in Android 13

#18

Post by cyber_kinetist »

insanitybit wrote: post #8

Glad to see robust work here. This strongly supports what should already be obvious, but sadly is not always understood; that memory safe languages are radically safer than memory unsafe languages. The impact is blatantly demonstrated here.

Rust (despite the common understanding) is not a memory-safe language in its entirety. It is a language designed to have a strict division of safe/unsafe which makes it easier for developers to compartmentalize code to achieve memory-safety.

Re: Memory Safe Languages in Android 13

#20

Post by goodpoint »

I'll be downvoted for pointing out that comparing C++ with Rust without further context can be made into a false dichotomy.

Some people are posting the article around the Internet as evidence that Rust solved security. Instead, there are many other memory safe languages around and there has been thousands in the past. Additionally, many security issues are not due to memory safety. Please keep that in mind when making comparisons.

EDIT: of course, 2 minutes and I'm downvoted down to -2

Post reply on HN