Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rex is a safe kernel extension framework that allows Rust in the place of eBPF

github.com

Post reply on HN
Print view View original

11–20 of 72 posts

Re: Rex is a safe kernel extension framework that allows Rust in the place of eBPF

#11

Post by NewJazz »

pjmlp wrote: post #6
bawolff wrote: post #3

> This approach avoids the overly restricted verification requirements (e.g., program complexity constraints) Maybe i'm missing something, but isn't that a bad thing?

Yes, very bad, even worse when coming from supposedly security conscious programming language community.

They're not in the core language group... Do these people have influence in the stdlib, compiler, prominent libraries? Kernel community?

Why judge the whole Rust community for the choices made by one minor subgroup?

Re: Rex is a safe kernel extension framework that allows Rust in the place of eBPF

#13

Post by testdelacc1 »

NewJazz wrote: post #11
pjmlp wrote: post #6

Earlier quoted context omitted.

Yes, very bad, even worse when coming from supposedly security conscious programming language community.

They're not in the core language group... Do these people have influence in the stdlib, compiler, prominent libraries? Kernel community? Why judge the whole Rust community for the choices made by one minor subgroup?

It’s a common HN trope to generalise a “community” based on a handful of people or even just one person. “See this is why I dislike the xyz community”, says a person justifying their confirmation bias.

Perhaps the world is too complex without breaking it down into in-groups and out-groups, with any out-groups supposedly being completely homogenous. Pretty intellectually lazy but fairly common on HN, to the point where it’s not even worth calling out.

Re: Rex is a safe kernel extension framework that allows Rust in the place of eBPF

#14

Post by [deleted] »

NewJazz wrote: post #11
pjmlp wrote: post #6

Earlier quoted context omitted.

Yes, very bad, even worse when coming from supposedly security conscious programming language community.

They're not in the core language group... Do these people have influence in the stdlib, compiler, prominent libraries? Kernel community? Why judge the whole Rust community for the choices made by one minor subgroup?

[deleted]

Re: Rex is a safe kernel extension framework that allows Rust in the place of eBPF

#15

Post by johnisgood »

testdelacc1 wrote: post #13
NewJazz wrote: post #11

Earlier quoted context omitted.

They're not in the core language group... Do these people have influence in the stdlib, compiler, prominent libraries? Kernel community? Why judge the whole Rust community for the choices made by one minor subgroup?

It’s a common HN trope to generalise a “community” based on a handful of people or even just one person. “See this is why I dislike the xyz community”, says a person justifying their confirmation bias. Perhaps the world is too complex without breaking it down into in-groups and out-groups, with any out-groups supposedly being completely homogenous. Pretty intellectually lazy but fairly common on HN, to the point wher…

I mean, I was going to reply "take a wild guess" to him, but your message is correct, too.

(I may come across as an Ada zealot myself.)

Re: Rex is a safe kernel extension framework that allows Rust in the place of eBPF

#16

Post by [deleted] »

NewJazz wrote: post #8
benatkin wrote: post #4

Earlier quoted context omitted.

In this comment someone tries to justify its design, citing a lwn article: https://github.com/rex-rs/rex/issues/2#issuecomment-26965339...

That's one aspect of the design. Again, complexity requirements are there for a reason. No explanation seen for why this eschews them.

[deleted]

Re: Rex is a safe kernel extension framework that allows Rust in the place of eBPF

#18

Post by _flux »

benatkin wrote: post #4
vlovich123 wrote: post #2

As a lover of Rust, ooo boy does this sound like a bad idea. The Rust compiler is not guaranteed to always output safe code against malicious inputs given that there’s numerous known soundness bugs that allow exploiting this. Unless I’m missing something this is a security nightmare of an idea. Also there’s reasons why eBPF programs aren’t allowed to run arbitrarily long and this just ignores that problem too.

In this comment someone tries to justify its design, citing a lwn article: https://github.com/rex-rs/rex/issues/2#issuecomment-26965339...

I think this is a fair take:

> We currently do not support unprivileged use case (same as BPF). Basically, Rex extensions are expected to be loaded by privileged context only.

As I understand it, in privileged context would be one where one is also be able to load new kernel modules, that also don't have any limitations, although I suppose the system could be configured otherwise as well for some reasons.

So this is like a more convenient way to inject kernel code at runtime than kernel modules or eBPF modules are, with some associated downsides (such as being less safe than eBPF; the question about non-termination seems apt at the end of the thread). It doesn't seem like they are targeting to actually put this into mainstream kernel, and I doubt it could really happen anyway..

Re: Rex is a safe kernel extension framework that allows Rust in the place of eBPF

#19

Post by jacquesm »

testdelacc1 wrote: post #13
NewJazz wrote: post #11

Earlier quoted context omitted.

They're not in the core language group... Do these people have influence in the stdlib, compiler, prominent libraries? Kernel community? Why judge the whole Rust community for the choices made by one minor subgroup?

It’s a common HN trope to generalise a “community” based on a handful of people or even just one person. “See this is why I dislike the xyz community”, says a person justifying their confirmation bias. Perhaps the world is too complex without breaking it down into in-groups and out-groups, with any out-groups supposedly being completely homogenous. Pretty intellectually lazy but fairly common on HN, to the point wher…

You may be correct but pjmlp is not one of those and if you had been here long enough you would have known that. You're the one creating an in-group here and putting yourself on the 'good' side. Perhaps that is too complex for you but I think it is intellectually lazy not to get who you're referring to before making comments such as these. Note that your strawman "See this is why I dislike the xyz community" wasn't part of this thread at all.

Re: Rex is a safe kernel extension framework that allows Rust in the place of eBPF

#20

Post by NewJazz »

_flux wrote: post #18
benatkin wrote: post #4

Earlier quoted context omitted.

In this comment someone tries to justify its design, citing a lwn article: https://github.com/rex-rs/rex/issues/2#issuecomment-26965339...

I think this is a fair take: > We currently do not support unprivileged use case (same as BPF). Basically, Rex extensions are expected to be loaded by privileged context only. As I understand it, in privileged context would be one where one is also be able to load new kernel modules, that also don't have any limitations, although I suppose the system could be configured otherwise as well for some reasons. So this is…

Yeah I agree with this assessment. It is not an eBPF replacement for many reasons. But could be a slightly safer alternative to kernel modules.
Post reply on HN