Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Welcome to Comprehensive Rust

google.github.io

Post reply on HN
Print view View original

61–70 of 204 posts

Re: Welcome to Comprehensive Rust

#61

Post by ohbtvz »

kibwen wrote: post #31
ohbtvz wrote: post #22

Earlier quoted context omitted.

I'm tired of installation instructions that consist of "curl | sh". Especially since this one just tries to detect the platform and downloads the correct installer for me. I know what platform I'm running, and I don't want to pipe the internet to my shell. In the end this is unpacking a tarball in ~/.rustup, I don't need the risk of running some bespoke script for that.

Since the ultimate objective is to run a binary blob that you just downloaded off of the internet, piping a script to your shell over HTTPS adds no additional attack surface.

You can't check the hash of something you immediately piping to your shell, for example.

Re: Welcome to Comprehensive Rust

#62

Post by izacus »

1f60c wrote: post #3

Is this “just” a 20% project or is this more significant (like Android one day supporting Rust to develop apps)? And I haven’t looked at everything yet, but it suggests to install Rust like this: sudo apt install cargo rust-src While everyone I know uses rustup^: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh ^ https://rustup.rs/

> Is this “just” a 20% project or is this more significant (like Android one day supporting Rust to develop apps)?

It's very unlikely you'll ever see Android supporting apps written in 100% Rust (just like it doesn't support apps written in 100% C++/C) - the APIs and UI toolkit are exposed and written in Java and you'll need to bridge either way.

Supporting Rust as a native code language to augment existing support for C/C++ via NDK is much more likely.

Re: Welcome to Comprehensive Rust

#63

Post by 9dev »

wongarsu wrote: post #15
incrudible wrote: post #2

The first thing I implore everyone to do when evaluating Rust is to check out a non trivial project and start hacking on it. I have always found the compiler to be unacceptably slow in these cases, especially if you come from C rather than C++. If you work your way up from Hello World you may not ever notice this until you already invested a substantial amount of effort.

On the other hand, I've always found it surprisingly easy to dive into non-trivial rust projects and start contributing, at a speed that would be unthinkable in C or C++. So I second the advise for non-trivial projects, they give a much better idea of the upsides and downsides of rust.

Is that really due to the language or that we collectively have become better in structuring software projects?

Re: Welcome to Comprehensive Rust

#64

Post by rowanG077 »

ergonaught wrote: post #37
rowanG077 wrote: post #5

Earlier quoted context omitted.

Could you point me towards a project where this is the case? I want to try it out as I never found Rust slow to compile.

“I’ve never been bothered by the compilation speed” is not the same thing as “It isn’t slow to compile.”

Sure! I didn't claim anything close "it isn't not slow to compile" and I'm not sure how you could interpret my comment like that. Notice how I clearly asked to be educated.

Re: Welcome to Comprehensive Rust

#65

Post by kibwen »

ohbtvz wrote: post #61
kibwen wrote: post #31

Earlier quoted context omitted.

Since the ultimate objective is to run a binary blob that you just downloaded off of the internet, piping a script to your shell over HTTPS adds no additional attack surface.

You can't check the hash of something you immediately piping to your shell, for example.

Checking the hash isn't relevant here. The content is served via HTTPS, you either trust the host or you don't. A host can easily serve you a malicious binary, as well as the valid hash of that malicious binary.

Re: Welcome to Comprehensive Rust

#66

Post by sofixa »

kibwen wrote: post #31
ohbtvz wrote: post #22

Earlier quoted context omitted.

I'm tired of installation instructions that consist of "curl | sh". Especially since this one just tries to detect the platform and downloads the correct installer for me. I know what platform I'm running, and I don't want to pipe the internet to my shell. In the end this is unpacking a tarball in ~/.rustup, I don't need the risk of running some bespoke script for that.

Since the ultimate objective is to run a binary blob that you just downloaded off of the internet, piping a script to your shell over HTTPS adds no additional attack surface.

You meant a binary blob in your distro's repository, so one that was checked, tested, approved and verified with a hash. Which is wildly different than downloading and running random binaries or scripts for that matter off the internet.

Re: Welcome to Comprehensive Rust

#67

Post by kibwen »

mhoad wrote: post #48
kibwen wrote: post #31

Earlier quoted context omitted.

Since the ultimate objective is to run a binary blob that you just downloaded off of the internet, piping a script to your shell over HTTPS adds no additional attack surface.

I get what you are trying to say here but I could also make the argument that you actually doubled it because now you have to trust two things rather than one. Depending on how you want to consider trust in a wider sense too it may even be worse than “double” because I do not have the same amount of trust for the package I am ultimately installing and the script I am using to install it. Edit: it’s actually 3 things…

> now you have to trust two things rather than one

No, you're still trusting one thing: the host itself. You're downloading both the script and the binary from the host. Both could be backdoored, and of the two, the binary is far easier to hide a backdoor in.

As for not trusting curl, you still need to fetch the resource somehow, so you're going to be trusting some tool to do it for you. That's not relevant to increasing the attack surface.

Re: Welcome to Comprehensive Rust

#68

Post by Gwypaas »

warabe wrote: post #39

It's kind of surprising to see that Rust is so rapidly accepted by wide range of developers. Unfortunately I'm from DataScience field, so I cannot see much motivation to learn Rust, but I am considering learning it, because language itself seems exciting! Is there anyone on HN who is from DataScience field like me and has learned Rust? It would be much appreciated if you could share the experience.

Rust has amazing integration with Python through PyO3 [1] so see it like a safe alternative for high performance calculations and operations.

The rust data science ecosystem itself is starting to come together with projects like Polars [2] (Pandas alternative), nalgebra [3], Datafusion [4] and Ballista [5]. Of course nowhere near Python but that is hard to beat today.

[1] https://github.com/PyO3/pyo3

[2] https://github.com/pola-rs/polars/

[3] https://github.com/dimforge/nalgebra

[4] https://github.com/apache/arrow-datafusion

[5] https://github.com/apache/arrow-ballista

Re: Welcome to Comprehensive Rust

#69

Post by danuker »

warabe wrote: post #39

It's kind of surprising to see that Rust is so rapidly accepted by wide range of developers. Unfortunately I'm from DataScience field, so I cannot see much motivation to learn Rust, but I am considering learning it, because language itself seems exciting! Is there anyone on HN who is from DataScience field like me and has learned Rust? It would be much appreciated if you could share the experience.

I suppose if you're coming from Python, you could use Rust (with PyO3) instead of C/C++/Cython in something similar to the Numpy/ML lower-level implementations.

But I wish there were a language that solved the two-languages problem (fast vs. easy to work with). I find Rust quite verbose.

Re: Welcome to Comprehensive Rust

#70

Post by jeroenhd »

kibwen wrote: post #65
ohbtvz wrote: post #61

Earlier quoted context omitted.

You can't check the hash of something you immediately piping to your shell, for example.

Checking the hash isn't relevant here. The content is served via HTTPS, you either trust the host or you don't. A host can easily serve you a malicious binary, as well as the valid hash of that malicious binary.

Which is why many people choose to only install software from their trusted distro maintainers who add a layer of vetting for random software packages, often built from source so messing with the package isn't possible without leaving some kind of trace that can be detected later.
Post reply on HN