- cross-posted to:
- pulse_of_truth@infosec.pub
You must log in or register to comment.
Super nice to have a proper metric.
People always talk about how great rust is. But I feel how gross c++ is isn’t talked about enough.
Linux Foundation, this is what could happen if you invested more than 2% in kernel development.
Great accomplishment. I think we all knew it must happen like this but it’s great to see real world results.
I think this is probably actually the most useful part of the post:
Increasing productivity: Safe Coding improves code correctness and developer productivity by shifting bug finding further left, before the code is even checked in. We see this shift showing up in important metrics such as rollback rates (emergency code revert due to an unanticipated bug). The Android team has observed that the rollback rate of Rust changes is less than half that of C++.
I think anyone writing Rust knows this but it’s quite hard to convince non-Rust developers that you will write fewer bugs in general (not just memory safety bugs) with Rust than with C++. It’s great to have a solid number to point to.
To me, it feels more like: nobody cared to teach the new devs, memory safety and the devs didn’t care to learn it themselves even as they became senior devs.
Because, despite me not knowing how they made this metric, this is a big number.
nobody cared to teach the new devs, memory safety and the devs didn’t care to learn it themselves even as they became senior devs.
It does not matter how much you teach, humans are not perfect. The industry changes all the time, everyone updates libraries, systems change, editing others code is not as easy to understand, and so on. There is a reason why Microsoft, Google and Linux have experts in their fields for decades and yet these mistakes happen.
And it makes sense why using Rust would reduce memory vulnerabilities. Because the language has features in place to either prevent or make those mistakes more difficult to happen. If you understand what Rust offers, then its not science to understand why. Google is not the first and only big company reporting this either.
It does not matter how much you teach
That’s 100% correct.
Those that don’t care, will still not care.Sure, I won’t go around saying, “I don’t make said mistakes”. I too, tend to leave the destructors to be written later.
But that doesn’t mean one can go on ignoring ignorance.In my last project I had some database CRUD operations. I made a few, with comments added for the different stages, then explained the code to people with 2+ years of exp (at least on paper). They then went on to make the other functions using mine as a reference.
There were no memory safety issues in that, as there was no room for it. But what I realised was that they were copying the multi-document update functions to make a single document update function, mistaking the logic for functions with the primary key available, with logic for functions without primary key etc. Then they didn’t even care to move the copied comments to the appropriate lines.
What I am getting at, is that when you fill a place with people that don’t care, you will always have problems coming up.That’s your little bubble. I don’t think its just not caring, its just super hard to write secure and correct code all the time. Especially writing operating systems such as Windows, Android and Linux Kernel in general is much different world. It’s not like those engineers trying to code correctly since computers actually exist.
But lets assume you are correct and all of this comes down to people not caring. Why don’t you get the job if you are really that good? I’m sure there are a few golden programmers like you, that the world would need. Or the industry adopts Rust (or a similar language) and have lot of security by default for free, for everyone. If its true what you are telling, then using such a language will make a difference.
And we are not speaking theoretically. There are metrics from Microsoft (and now from Google) which show improvements and advancements since Rust was adopted. But really, to say that those engineers and programmer don’t care is just a wrong statement. Okay, you have no metrics to prove your point, but you are questioning reports from Google.
, that the world would need. Or the industry adopts Rust (or a similar language) and have lot of security by default for free
I can see you didn’t care to understand the example I gave. Rust wouldn’t have fixed the problem that happened in my bubble.
I can also see, you somehow think I am against Rust, just because I am for people caring about what they write.
are questioning reports from Google
No. I am interpreting the single number 52%, that came out of the report from Google, without caring about the meaning about the metric.
And that’s what is causing you to not like what I wrote.
It’s almost as if it is important to care about the context of what you are writing into. See what I did there?And you didn’t care what I wrote. Its not about your bubble and nobody cares what problem you had. You are bringing your argumentation in a topic up, where it does not apply. We are specifically talk about problems that Rust could help against. And you take your argumentation of your personal experience as a reason that people at Google, Microsoft and other big companies didn’t want to learn and don’t care.
And when I point it out, then it means people didn’t care to understand your example.
Look, you can tell what you want, using and adopting Rust has real impact in writing and maintaining complex and important code that is secure. There are reports left and right. It’s not hard to understand why Rust prevents or helps with these issues.
Your reply came out as, one that was trying to refute the claim of some anti-Rust comment. Which the previous comment was not.
The way Rust works, clearly shows that it was developed by people who cared about those things.
And just because something happened in my bubble, doesn’t directly prove it to not be happening anywhere else, just because it doesn’t prove otherwise.
Then why do you bring that up, after the argumentation that people did not want to learn? Look I try to be constructive. There are people who do not want to learn, but saying that all security issues is to attribute to that is wrong. Lot of the best engineers and programmers do their best, long time experts and groups, who still make mistakes.
What i"m saying is, that your example is not applicable in this discussion, because you are not writing systems programming for operating systems (such as Android or Windows or Linux), which are used by millions of people and ton of hackers try to find vulnerabilities. The best programmers in C and C++ make these mistakes that Rust would prevent (or make it much easier to find and eliminate).
That’s the point. It’s not about these experts not wanting to learn or not caring. We are not talking about the typical programmer for a website for company x or a fake game programmer for Android.