It wouldn't noticeably change the unit economics. Very few attacks rely on memory exploits.

Edit: This appears to be confusing to people, so here are some examples you'll recall from the past few years: SolarWinds, the Colonial Pipeline hack, the Okta breach, the Uber breach. Most attacks don't rely on memory exploits.

Ironically Mozilla began to sponsor Rust as part of their Servo project. Before they laid everyone off and made Servo a volunteer-run project.

I do feel they should have persevered. Although, yeah, writing a new rendering engine from scratch is a big job.

Sadly, humans would remain the weakest link (in terms of PWNing defenses).

I don't think so. Outside of labs, I can't remember needing memory safety exploitation or hearing about a major compromise that used such an exploit.

I am not saying the security improvements are not real, just not orders of magnitude. For example some post exploitation stuff like BYOVD I am sure would be much harder.

A lot of vulns are just mistakes people made. Perhaps LLMs can help with that in the neat future but right now you hardly even need a CVE to compromise even well protected networks. A little phish here, a little abuse of legit software there, patiently look for services and credentials that aren't well protected and voila. Few actors use 0days and auto-updates have made 1-days hard to rely on

You say that like you know for certain that this isn't part of such a thing!

P.S. Subtle reference, love the product placement.

I don't know what it's like now, but back in the day devdiv (owners of Visual Studio, .Net, etc.) and Windows were highly siloed and it was hard to get them to align on a common way forward. Rust seems like the sort of thing devdiv would naturally pick up though.

From an outsider’s perspective, it seems like MS (meaning the “new” MS under Nadella) is more aligned under VS Code than their traditional Visual Studio product.

I don’t doubt that Visual Studio will continue to be developed, but it would surprise me to see MS direct Rust resources specifically to it when they’ve already dedicated a lot of work towards Rust in VS Code.

(This is coming from someone who feels mild resentment at how much better the Rust editing experience is in VS Code than his preferred editors.)

Have you tried it on VS Code? Have found the Rust experience in VS Code to be pretty good.

Visual Studio is on its way out, and I say that as someone that uses it professionally every single workday. They've been monkey-patching in features now for years, and it remains slow and bloated.

VSCode is the future and Microsoft's future. The current limited .Net support on VSCode feels like it is intentional to give Visual Studio another few years.

PS - Obviously Visual Studio will never ACTUALLY go away. I am talking about as its flagship product for current/future development, it will remain for things like Windows Forms and other dead-end tech.

It's really silly how much better Fast tiny 3rd party programs like everything search so much faster than windows search

I personally gave up on GUI file searching a long ago, it's one thing that sucks everywhere IMHO. I'll take CLI tools like locate or `fd` any day, they are IMHO quicker to use even on Windows.

Just use Everything (https://www.voidtools.com/), so much better than Windows Search.

How many years and counting and MS still can't make search work? So much comments about how search is screwed up. For me I can't stand it sometimes doesn't find that I know there is. Or sometimes I don't really know that something is or is not there because I can't trust the search. And sometimes it just wont search. Or does it really slowly

Ugh that whole talk is announcing a whole bunch of things that make it much harder for smaller devs to get started. They want a signing chain that will inevitably cost thousands of dollars just to get approved with some sort of annual fee tacked on as well, so as a independent dev you can either go through that rigmarole or just not target windows, or you need to walk your users through disabling the smart filter thing first...

adminless and passwordless windows: population 9001 (spyware telemetry entities)

The kernel space of Windows is not a problem, it has been fit-for-purpose and even good for the last 20-odd years. The problem is the deterioration in the UI and UX side of the OS (adware, spyware, hodgepodge of UI paradigms, spotty GUI settings apps, reset of preferences after any serious update, bad built-in tooling forced on the user etc).

Listen to them talking about it. This isn’t the sound of rogue group of developers focused on creating job security for themselves

https://youtu.be/8T6ClX-y2AE?t=2607

I can’t disagree more. I hesitate to hitch my cart to Rust, but rewriting all the old memory unsafe code is an inevitable need. This status quo of just patching things up every time an exploit appears is farcical when we have the tools to address these problems today.

This is how I feel about devs forcing rust onto web UI development (https://news.ycombinator.com/item?id=35722681). JS exists and people already make new toys (frameworks) for it every month. That's not enough and now we need rust on the frontend

  - Cannot have garbage collection
  - Need the raw speed of C
  - Need to provide a C interface
  - Already have a lot of Rust code in the project

I think that "let people rewrite stuff in the new cool language/framework" is a deliberate strategy to retain midrange talent.

Because when I think of what would give me the most job security, it's to reimplement something that we already have and works perfectly fine on its own.