Readit News logoReadit News

Dead Comment

Deleted Comment

Dead Comment

Dead Comment

Deleted Comment

damnyou commented on Mitigating Memory Safety Issues in Open Source Software   security.googleblog.com/2... · Posted by u/littlestymaar
notpygame · 5 years ago
The recent track record of curl shows it has zero reported memory safety issues recently. Reading the article and the old linked research you'd be mislead.

It also states that Rust completely prevents them - it does not. The article talks about mitigation, but also says: "would have been completely prevented by using a memory-safe language". The "completely prevented" claim in the article is the one not supported by current research. If you only read this article, you'd be mislead about memory safety in Rust.

damnyou · 5 years ago
No memory safe language in existence can meet your standards, since they're all written on a bedrock of unsafe code.
damnyou commented on Mitigating Memory Safety Issues in Open Source Software   security.googleblog.com/2... · Posted by u/littlestymaar
notpygame · 5 years ago
The security information about C and curl is a bit outdated in the post, and recent research shows Rust does not solve the memory safety issue.

The "recent study" quoted in the article was published at the beginning of 2019, using older data.

Current vulnerability data shows that curl has very much limited the risk of memory safety issues. How many reported security vulnerabilities in the last two releases of curl? Zero so far. You have to go back 9 months before you find one expired-pointer derefence issue resulting in potential data being sent to the wrong connection in rare circumstances and configurations. Which is a logic error that could happen in Rust too.

To quote from a Oct 2020 study on Rust safety - "Our study results reveal that while Rust successfully limits the risks of memory-safety issues in the realm of unsafe code, it also introduces some side effects. In particular, most of the use-after-free and double-free bugs in our data set are related to the automatic drop scheme associated with the ownership-based memory management model." -- "Memory-Safety Challenge Considered Solved? An In-Depth Study with All Rust CVEs"

They study 60 Rust memory safety vulnerabilities.

As you can see not only does Rust not solve the memory safety problem, it has other issues. Additionally the old research quoted misleads people about the current status of reported memory safety issues in curl.

damnyou · 5 years ago
Safe Rust solves the problem of memory safety (assuming that any unsafe code is correct). Unsafe Rust continues to be potentially memory unsafe. That is equivalent to other memory safe languages like Java (which is memory safe under the assumption that the JVM has no memory safety bugs and any JNI code is correct), and a very large improvement over C and C++.

Dead Comment

Dead Comment

damnyou commented on Scott Siskind believes scientific racism is “probably partially correct”   twitter.com/TopherTBrenna... · Posted by u/damnyou
Bostonian · 5 years ago
Siskind is very thoughtful and reads a lot. If, after weighing the evidence, he concluded that some of the white/black difference on IQ tests is probably genetic, that does not make him a bad person or a "white supremacist", unless he has advocated denying civil rights to blacks. He has not done so.

There is much current discussion of how to deal with racial disparities in outcomes in employment and education. What to do about them depends on what factors cause them, which should be studied objectively.

damnyou · 5 years ago
Yes, yes, that's the standard scientific racist line. "Oh we just care about educational outcomes".

u/damnyou

KarmaCake day-11June 2, 2017View Original