Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Welcome to Comprehensive Rust

google.github.io

Post reply on HN
Print view View original

141–150 of 204 posts

Re: Welcome to Comprehensive Rust

#141

Post by Someone »

kibwen wrote: post #67
mhoad wrote: post #48

Earlier quoted context omitted.

I get what you are trying to say here but I could also make the argument that you actually doubled it because now you have to trust two things rather than one. Depending on how you want to consider trust in a wider sense too it may even be worse than “double” because I do not have the same amount of trust for the package I am ultimately installing and the script I am using to install it. Edit: it’s actually 3 things…

> now you have to trust two things rather than one No, you're still trusting one thing: the host itself. You're downloading both the script and the binary from the host. Both could be backdoored, and of the two, the binary is far easier to hide a backdoor in. As for not trusting curl, you still need to fetch the resource somehow , so you're going to be trusting some tool to do it for you. That's not relevant to incre…

> You're downloading both the script and the binary from the host.

Technically, if you don’t read the script, you don’t know the binary is from the same host.

That doesn’t matter, though. The chain of trust is deep, including the tooling that produced the binary, your CPU, the internet, etc.

Downloading the first file basically says “I trust this site to give me this tool and nothing else”. Where it then gets that stuff from shouldn’t matter, even if it is from a shady site. You trusted them not to do that, just as you trusted them not to open up their own site so that hackers can replace files ont it.

Re: Welcome to Comprehensive Rust

#142

Post by fulafel »

mrtngslr wrote: post #95
lillecarl wrote: post #81

Earlier quoted context omitted.

Rust does not guarantee that there are no memory leaks, you can have things reference eachother and therefore never count to 0. This is why weak pointers exist in rust.

Right, this is a problem with reference counted data structures in general. You're correct that Rust doesn't try to solve this particular problem. Put differently, the borrow checker won't allow you to create a cycle of refrences (the & kind). But you can do it with library types such as Rc.

It's a property of basic RC but real-world RC based GC systems can often collect reference cycles. For example Python and PHP do this.

(I'm sure you knew this, just adding to the discussion)

Re: Welcome to Comprehensive Rust

#143

Post by thesuperbigfrog »

eggy wrote: post #86

I still play with Rust (and Zig), but I have decided to put my work efforts into SPARK[1], the subset of Ada, for high-integrity software and formal verification. I know AdaCore and Ferrous Systems are collaborating in trying to bring a lot of Ada/Spark's capabilities to Rust, but this is still going to be some time. Ada has a longer legacy in this game. I am working on safety critical control systems and there is a…

More about Ferrocene, the safety-critical Rust toolchain / specification that is in the works:

https://www.adacore.com/ferrocene

https://ferrous-systems.com/ferrocene/

https://spec.ferrocene.dev/

Re: Welcome to Comprehensive Rust

#144

Post by insanitybit »

jjgreen wrote: post #52
kibwen wrote: post #31

Earlier quoted context omitted.

Since the ultimate objective is to run a binary blob that you just downloaded off of the internet, piping a script to your shell over HTTPS adds no additional attack surface.

Actually no, one can detect curl-piping server-side and serve hostile blobs only to those foolish enough to do so: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

Changing nothing about the relative security of using curl | sh.

Re: Welcome to Comprehensive Rust

#145

Post by rockisch »

sharikous wrote: post #77
warabe wrote: post #39

It's kind of surprising to see that Rust is so rapidly accepted by wide range of developers. Unfortunately I'm from DataScience field, so I cannot see much motivation to learn Rust, but I am considering learning it, because language itself seems exciting! Is there anyone on HN who is from DataScience field like me and has learned Rust? It would be much appreciated if you could share the experience.

We developers love so much to learn computer stuff that we want to do it even when we don't need to. I worked on data science, computational science, some system engineering and embedded projects. I tried Rust on all of them but it was valuable only for the third. In data science the focus is more on speed of development and as much as Rust is more enjoyable to use than C++, it doesn't match scripting languages (name…

Idk how long ago you tried doing embedded Rust, but nowadays it is quite decent. I think I'd choose Rust over C for embedded 99% of the time.

Re: Welcome to Comprehensive Rust

#146

Post by fulafel »

pornel wrote: post #118
jjgreen wrote: post #87

Earlier quoted context omitted.

And where is this trust supposed to come from? I downloaded the thing manually, looked at the scripts, ran the binary in a sandbox, it seemed to be OK. Right, I'll recommend that everyone just curl | bash's it ... I think the worst thing about this is that Rust is fashionable, so encouraging inexperienced devs think that these dangerous practices are just fine. Look around at how many n00b projects now suggest doing…

The bash timing exploit makes everyone focus just on how cleverly evil it can be, and forget the big picture that it's about trusting the Rust org not to screw you. (BTW, you can run `curl | sh` in a VM or with a modified bash to intercept the code and catch the bash script in the act, so it's not actually as sneaky as people believe). If you think the Rust org is going to pwn you in a clever sneaky way, then you can…

"Trusting the Rust org not to screw you" is one part, another part is trusting the Rust server operators to defend against server compromise by any third party. So trusting the intentions is not sufficient.

Re: Welcome to Comprehensive Rust

#147

Post by carapace »

pornel wrote: post #118
jjgreen wrote: post #87

Earlier quoted context omitted.

And where is this trust supposed to come from? I downloaded the thing manually, looked at the scripts, ran the binary in a sandbox, it seemed to be OK. Right, I'll recommend that everyone just curl | bash's it ... I think the worst thing about this is that Rust is fashionable, so encouraging inexperienced devs think that these dangerous practices are just fine. Look around at how many n00b projects now suggest doing…

The bash timing exploit makes everyone focus just on how cleverly evil it can be, and forget the big picture that it's about trusting the Rust org not to screw you. (BTW, you can run `curl | sh` in a VM or with a modified bash to intercept the code and catch the bash script in the act, so it's not actually as sneaky as people believe). If you think the Rust org is going to pwn you in a clever sneaky way, then you can…

I call this the "Lie back and think of England" stance.

You're not wrong, until the end, it should be: "you have to distrust the Rust org, all of it."

And not just Rust, Python and JS and all the others. There are languages and systems that take trust and security seriously, but these are not they.

Re: Welcome to Comprehensive Rust

#148

Post by eloff »

fulafel wrote: post #142
mrtngslr wrote: post #95

Earlier quoted context omitted.

Right, this is a problem with reference counted data structures in general. You're correct that Rust doesn't try to solve this particular problem. Put differently, the borrow checker won't allow you to create a cycle of refrences (the & kind). But you can do it with library types such as Rc.

It's a property of basic RC but real-world RC based GC systems can often collect reference cycles. For example Python and PHP do this. (I'm sure you knew this, just adding to the discussion)

Rust doesn’t though. But it does make it much harder to leak memory than C. You need to create a cycle between reference counted objects versus just forget to free something.

Not that it matters as much as people think. Memory leaks aren’t a correctness problem. You typically want to restart a program or service regularly anyway to deal with memory fragmentation. You also frequently have a watchdog like systemd to restart your program if it crashes. Heroku restarts your whole dyno once a day. This means in practice that programs with slow memory leaks tend to work just fine (there are plenty of them in the wild.)

Re: Welcome to Comprehensive Rust

#150

Post by bobajeff »

eggy wrote: post #86

I still play with Rust (and Zig), but I have decided to put my work efforts into SPARK[1], the subset of Ada, for high-integrity software and formal verification. I know AdaCore and Ferrous Systems are collaborating in trying to bring a lot of Ada/Spark's capabilities to Rust, but this is still going to be some time. Ada has a longer legacy in this game. I am working on safety critical control systems and there is a…

I've looked a tiny bit into Ada and I like the language. I particularly like the pascal-like syntax and the ranges feature.

However I love rusts cargo and build system better than Alire. As Alire seems to bolted ontop of gprbuild. I also find it unfun to go back to forward declaration and definition (ads) files.

It also seems to me the rust ecosystem has more libraries in things I'm interested in and better support for the platforms I'm interested in.

Post reply on HN