Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

edera.dev

Post reply on HN
Print view View original

21–30 of 59 posts

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#21

Post by Veserv »

normie3000 wrote: post #17
aDyslecticCrow wrote: post #11

Earlier quoted context omitted.

I personally suspect it's an effect of the over reliance of the package manager approach to software development that rust and a few other languages use, which itself is an unintended to consequence of a well designed library import system. Languages where importing a library is hard, libraries tend to grow quite large. Large libraries have larger backing, more established development and security protocols. When Ope…

I haven't seen this perspective before but it's a very elegant explanation for why e.g. npm is so much scarier than maven. I wonder if safety could be improved a little if private package management was easier than throwing things out in public.

Newer languages have made packaging and importing dependencys significantly easier, but have done this while increasing coupling and making switching dependencys harder. This results in brittle dependency trees.

Using a private package manager, intermixing private and public, and substituting arbitrary dependencys with compatible alternatives, i.e. modularity, should be easy. Only then does solving the problem become easy.

What we used to have is a big ball of mud. Modern languages made it easier to decompose a system into components. But what we really want is easily decomposing a system into modular components which is yet unsolved.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#22

Post by hsbauauvhabzb »

cozzyd wrote: post #16
hsbauauvhabzb wrote: post #13

Earlier quoted context omitted.

Package management systems are scary before packages are abandoned too. Your production infrastructure is trusting some random developer/s to both do the right thing and not get hacked. That’s not to say oss cannot be trusted, but it certainly makes trusting smaller projects and packages scary.

In principle "traditional" curated Linux distro package systems will patch stuff even if upstream is unresponsive.

Sorry I should have clarified that I was referring to language based systems (cargo, pip, npm, etc). But you do raise a good point, it’s less about the concept of package management and more around the point of curation and central security guarantees / policies / procedures. In theory RHEL package management system could have similar problems to cargo or npm, but they are much better funded and thus managed.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#23

Post by TZubiri »

arresin wrote: post #8

From my experience abandoned repos is common in rust. Why is this?

1. Radical new paradigm that critiques and disregards most of the traditional infrastructure.

2. Completely FOSS, barely any salaried devs, if any they are donation based.

3. Culture for code "reuse" instead of actually coding. Everyone wants it in their own flavour (we have tar, but I kinda want async-oop-tar)

4. Cognitive dissonance between 3 and 1, rusties don't want to succumb and use a standard tar library because of performance (self inflicted performance hit from creating an incompatible ecosystem) or pride (we need a version written in rust). All of this to download software that is probably written in C and from another ecosystem anyways. (An encoding/compression is a signature and tarballs are signature CLinux)

Something's gotta give

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#25

Post by woodruffw »

greatgib wrote: post #24

I'm so confused, I was thinking that we were rewriting everything from C to Rust because Rust was a "safe language" preventing vulnerabilities...

To the best of my knowledge, nobody has ever seriously claimed that Rust (or any other general purpose programming language) can fully prevent logic errors.

Rust's advantage is that it can prevent logic errors from becoming memory safety vulnerabilities (and separately, its type system makes some - but not all - classes of logic errors more difficult to introduce).

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#26

Post by oguz-ismail »

dathinab wrote: post #14
arresin wrote: post #8

From my experience abandoned repos is common in rust. Why is this?

(no specific order) 1. easy to create 2. easy to produce something with decent quality 3. rust is widely used by a lot of people, including juniors which don't know (yet) that it can be quite a pain to maintain a package and that it comes with some responsibility 4. so small hobby projects now can very easily become widely used dependencies as people looked at them and found them to have decent quality 5. currently "…

> rust is widely used by a lot of people

it's used for rewriting CLI utilities with more color by five or so people

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#27

Post by meltyness »

arresin wrote: post #8

From my experience abandoned repos is common in rust. Why is this?

Optimistically because the component was considered self-contained, and done?

If you build things with wires, diodes, multiplexers, breakers, fuses and keyed connectors there's less maintenance needed than if you try and build a system entirely out of transistors and manually applied insulators.

I haven't looked at the package itself, but was it built on top of the C libraries with like, bindgen?

e: a glance suggests thats not the case, but perhaps they were ported naively by simply cloning the structure without looking at what it was implementing? that's definitely the path of least resistance for this type of thing. On top of that the spec itself is apparently in POSIX, some parts of which are, well, spotty; compared to RFCs

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#28

Post by kibwen »

arresin wrote: post #8

From my experience abandoned repos is common in rust. Why is this?

Compared to C, Rust makes it easy to push stuff to a place that people will find it. That's the major difference. With C, people push their half-finished projects to Github where they drown in Github's poor discovery; in Rust they push their half-finished stuff to crates.io where people have more than half a chance to actually find it via a casual search.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#29

Post by kibwen »

aDyslecticCrow wrote: post #11
arresin wrote: post #8

From my experience abandoned repos is common in rust. Why is this?

I personally suspect it's an effect of the over reliance of the package manager approach to software development that rust and a few other languages use, which itself is an unintended to consequence of a well designed library import system. Languages where importing a library is hard, libraries tend to grow quite large. Large libraries have larger backing, more established development and security protocols. When Ope…

But Rust doesn't have an abundance of small/atomic libraries. This is describing NPM, not crates.io. Rust doesn't have the same culture as Node.

Re: Tarmageddon: RCE vulnerability highlights challenges of open source abandonware

#30

Post by Ygg2 »

TZubiri wrote: post #23
arresin wrote: post #8

From my experience abandoned repos is common in rust. Why is this?

1. Radical new paradigm that critiques and disregards most of the traditional infrastructure. 2. Completely FOSS, barely any salaried devs, if any they are donation based. 3. Culture for code "reuse" instead of actually coding. Everyone wants it in their own flavour (we have tar, but I kinda want async-oop-tar) 4. Cognitive dissonance between 3 and 1, rusties don't want to succumb and use a standard tar library becau…

> rusties don't want to succumb and use a standard tar library because of performance (self inflicted performance hit from creating an incompatible ecosystem) or pride (we need a version written in rust).

Pure BS. If I wrote something in Rust rather than a binding it was because using often Linux based C libs on all Tier 1 platform is as smooth of a process as swimming in shards of glass.

Post reply on HN