[dead]
The state of the kernel Rust experiment
121–130 of 148 posts
Re: The state of the kernel Rust experiment
#122Earlier quoted context omitted.
I suspect more the latter than anything. It could be that by the time Rust gets used in the kernel core, one or both of the GCC implementations would be functional enough to compile the kernel. I'm curious though, if someone has an ancient/niche architecture, what's the benefit of wanting newer kernels to the point where it'd be a concern for development? I presume that outside of devices and drivers, there's little…
No one is doing any kind of serious computing on 30 year old CPUs. But the point of the hobby isn’t turning on the computer and doing nothing with it. The hobby is putting together all the pieces you need to turn it on, turning it on and then doing nothing with it. There’s an asymmetry in what the retro computing enthusiasts are asking for and the amount of effort they’re willing to put in. This niche hobby benefits…
[dead]
Re: The state of the kernel Rust experiment
#123Earlier quoted context omitted.
Okay, fair that since the majority of the codebase is C and that 150 vulnerabilities is probably negligible in comparison since we're talking about ratios, but if we're to be THAT nuanced then we also need to consider that code has been iterated upon for decades, so, I think the point is moot. The claim has never, ever, been that Rust is bug free. The objective was to help reduce bugs, which is an outcome I've seen f…
What features do you like the most in Rust? Are pattern matching and enums some of them?
Ah, credibility attacks. Nice.
Re: The state of the kernel Rust experiment
#124Earlier quoted context omitted.
The first misunderstanding is that safety is a property of the language or not. Rust marketing convinced many people that this is so, but C can be safe or unsafe. Fil-C shows that even all of C can be memory safe (but at a substantial cost in performance). But even just with GCC and Clang, array access and signed integer can be made safe with a compiler flag, and a violation then traps and this is similar to a Rust p…
I guess that means you're using the colloquial meaning of the word safety/unsafe rather than the rust definition. It's worth being explicit about that (or choosing a different word) in these discussions to prevent confusion. For Rust safety (meaning no UB) most definitely is a property of the language. If a module does not contain unsafe and the modules it uses that do contain unsafe are implemented soundly then ther…
No, in the comment you reply to, I am using safe/unsafe in the Rust sense. E.g. signed overflow changed to trap avoids the UB.
Also "If .. are implemented soundly" sounds harmless but simply means there is no safety guarantee (in contrast to Fil-C or formally verified C, for example). It relies on best-effort manual review. (but even without "unsafe" use anywhere, there are various issues in Rust's type system which would still allow UB but I agree that this is not that critical)
In C UB is part of the ISO language specification, but not necessarily part of a specific implementation of ISO C. If you argue that the ISO spec matters so much, I like to point out that Rust does not even have one, so from this perspective it is completely UB.
Re: The state of the kernel Rust experiment
#125If you build a house out of inflammable bricks instead of magnesium ones you can at least rule out magnesium fires. Now the question is: If we live in a world where magnesium fires are common, can we afford to not at least try building with the inflammable bricks? I know this topic stokes emotions, but if you haven't tried Rust as someone with C/C++ experience, give it a go. You will come out wiser on the other side,…
Inflammable doesn’t mean not flammable. It means able to be inflamed. Language changes over time but this word is particularly problematic, so I’d avoid it to avoid confusion.
Thanks for the correction, English is not my first language.
Re: The state of the kernel Rust experiment
#126Earlier quoted context omitted.
I've done a bit of work with Rust, and while I did find some of the complexity frustrating, it wasn't _that_ bad. While I could sort of see some situation like you describe with a secret agenda from big tech, I think that probably requires significantly more cunning & organisation than they actually have around this stuff. It's not like Microsoft invented Rust - in fact it came from a relatively small corp in the fir…
It is irrelevant who invented Rust. The relevant fact is that it can be used as a tool to divide the community because of its very opinionated design. Systemd was equally opinionated and also caused huge division. Who is paying the bills of Poettering these days: Microsoft. The Halloween documents show that Microsoft is playing these games for a long time now. Who knows in which way they have advanced their psyops. J…
Not to be that guy, but the design of C is both incredibly opinionated and those opinions demonstrably made/make systems insecure.
And I say this as someone who programs C/C++ on embedded. Just because C has a lot undefined bahvior doesn't mean it is unopinionated.
Re: The state of the kernel Rust experiment
#127Earlier quoted context omitted.
Maybe you haven't been paying much attention in this space. Google found empirically that error density in _unsafe_ Rust is still much lower than in C/C++. And only a small portion of code is unsafe. So per LOC Rust has orders of magnitudes fewer errors than C/C++ in real world Android development. And these are not small sample sizes. By now more code is being written in Rust than C++ at Google: https://security.goo…
[flagged]
What about qmail? No one runs qmail and no one is writing new C with that kind of insanely hyperconservative style using only world-class security experts.
And it still wasn't enough. qmail has seen RCEs [0, 1] because DJB didn't consider integer and buffer overflows in-scope for the application.
[0] https://www.guninski.com/where_do_you_want_billg_to_go_today...
Re: The state of the kernel Rust experiment
#128Earlier quoted context omitted.
All of `Vec` is much smaller than all of the place using Vec. IIRC, Vec is around 3k LoC. And for even low level code like Oxide & Android core, they are observed less than 4% of their code is inside or related to unsafe, that’s a massive improvement. Yes, Rust is not new in term of allow building hard to misuse abstraction, it’s just allow abstraction over memory safety without relying on GC or runtime checks. Rust…
[flagged]
Wow, now no more discussion and an accuse of bot? I’m flattered.
Also you are doing tech, be specific, what is much shallower or hollow?
Re: The state of the kernel Rust experiment
#129Earlier quoted context omitted.
What number of CVEs is Rust kernel code allowed to have before we have good evidence it’s a categorical failure? Do you turn off KASLR for your Linux machines because there exist CVEs it doesn’t protect against?
As long as the kernel will be developed, there will be CVEs - even with Rust. So at what point the number is so high that we should drop Rust and move to formal verification? And even then, there will be CVEs... This whole argument is nonsense. But I also do not agree that memory safety is of much higher importance than other issues. Memory safety is highly critical if you have a monopolistic walled garden spyware ec…
Your priorities do not match that of most kernel developers or most operators of network-connected Linux systems (even if we ignore Android). So I don’t think your problem is with Rust at all, you’ll need to fork Linux if you want the project to stop putting huge amounts of effort into memory safety (as it has for decades).
Re: The state of the kernel Rust experiment
#130From the comment section: > To me the more salient questions are how long before (a) we get Rust in a core subsystem (thus making Rust truly _required_ instead of "optional unless you have hardware foo"), and (b) requiring Rust for _all_ new code. Previously, the position was that C developers would not be forced to learn Rust. And a few days ago a security vulnerability was found in the Rust Linux kernel code. https…
As Rust's advantages over C continue to be proven, a shift in position to "suck it up, C devs" is to be expected.
Eh, these are highly skilled individuals that just don't like learning a new thing, no matter how useful. That attitude is a problem to be managed, but these people deserve a certain amount of respect. Anyone saying "suck it" or similar should get a grip.