Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Brite
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (Cyborg)
  • No Skin
Collapse
Brand Logo

CIRCLE WITH A DOT

  1. Home
  2. Uncategorized
  3. The coreutils Rust rewrite story is pretty funny.

The coreutils Rust rewrite story is pretty funny.

Scheduled Pinned Locked Moved Uncategorized
47 Posts 27 Posters 173 Views
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • lcamtuf@infosec.exchangeL This user is from outside of this forum
    lcamtuf@infosec.exchangeL This user is from outside of this forum
    lcamtuf@infosec.exchange
    wrote last edited by
    #1

    The coreutils Rust rewrite story is pretty funny.

    Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

    But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

    Link Preview Image
    oss-sec: uutils coreutils CVEs

    favicon

    (seclists.org)

    PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

    chuckmcmanis@chaos.socialC synlogic4242@social.vivaldi.netS pikhq@social.treehouse.systemsP simonzerafa@infosec.exchangeS prozacchiwawa@functional.cafeP 19 Replies Last reply
    1
    0
    • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

      The coreutils Rust rewrite story is pretty funny.

      Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

      But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

      Link Preview Image
      oss-sec: uutils coreutils CVEs

      favicon

      (seclists.org)

      PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

      chuckmcmanis@chaos.socialC This user is from outside of this forum
      chuckmcmanis@chaos.socialC This user is from outside of this forum
      chuckmcmanis@chaos.social
      wrote last edited by
      #2

      @lcamtuf mumble, mumble, Chesterson's Fence, mumble, mumble

      darkuncle@infosec.exchangeD 1 Reply Last reply
      0
      • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

        The coreutils Rust rewrite story is pretty funny.

        Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

        But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

        Link Preview Image
        oss-sec: uutils coreutils CVEs

        favicon

        (seclists.org)

        PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

        synlogic4242@social.vivaldi.netS This user is from outside of this forum
        synlogic4242@social.vivaldi.netS This user is from outside of this forum
        synlogic4242@social.vivaldi.net
        wrote last edited by
        #3

        @lcamtuf Rustaceans are the problem, not Rust itself. theyre like a lobbing group trying explicitly to boost their future employment demand much more than prioritized on doing the right thing as engineers or for the community. much like the AI VC are "talking up their book" even if its poison for the rest of us

        rmq@toot.ioR 1 Reply Last reply
        0
        • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

          The coreutils Rust rewrite story is pretty funny.

          Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

          But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

          Link Preview Image
          oss-sec: uutils coreutils CVEs

          favicon

          (seclists.org)

          PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

          pikhq@social.treehouse.systemsP This user is from outside of this forum
          pikhq@social.treehouse.systemsP This user is from outside of this forum
          pikhq@social.treehouse.systems
          wrote last edited by
          #4

          @lcamtuf and it's very worth remembering that while the design of rust _does_ prevent many bugs, it's not a get-out-of-bugs-free card. there are many ways to write code wrong, not just memory safety issues!

          petrillic@hachyderm.ioP 1 Reply Last reply
          0
          • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

            The coreutils Rust rewrite story is pretty funny.

            Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

            But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

            Link Preview Image
            oss-sec: uutils coreutils CVEs

            favicon

            (seclists.org)

            PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

            simonzerafa@infosec.exchangeS This user is from outside of this forum
            simonzerafa@infosec.exchangeS This user is from outside of this forum
            simonzerafa@infosec.exchange
            wrote last edited by
            #5

            @lcamtuf

            Deus forbitbthey create a functional specification of how the existing utilities work, before converting / rewriting them in a new language 😟🤦‍♂️

            drwho@masto.hackers.townD 1 Reply Last reply
            0
            • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

              The coreutils Rust rewrite story is pretty funny.

              Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

              But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

              Link Preview Image
              oss-sec: uutils coreutils CVEs

              favicon

              (seclists.org)

              PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

              prozacchiwawa@functional.cafeP This user is from outside of this forum
              prozacchiwawa@functional.cafeP This user is from outside of this forum
              prozacchiwawa@functional.cafe
              wrote last edited by
              #6

              @lcamtuf i do find that the crates dedicated to atomic file handling and temp files, in the interest of providing a uniform platform interface aren't as good as what's reachable in c.

              it's not a fault of the rust language per se, but writing a safe interface at that level isn't easy, so it makes sense (and is in some sense a better default) to have high level, platform neutral access here.

              1 Reply Last reply
              0
              • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                The coreutils Rust rewrite story is pretty funny.

                Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                Link Preview Image
                oss-sec: uutils coreutils CVEs

                favicon

                (seclists.org)

                PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                xerz@soc.masfloss.netX This user is from outside of this forum
                xerz@soc.masfloss.netX This user is from outside of this forum
                xerz@soc.masfloss.net
                wrote last edited by
                #7

                @lcamtuf ........ouch

                I'm shocked they didn't account for any of that

                hypha@cafe.mycelium.locahlo.stH 1 Reply Last reply
                0
                • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                  The coreutils Rust rewrite story is pretty funny.

                  Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                  But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                  Link Preview Image
                  oss-sec: uutils coreutils CVEs

                  favicon

                  (seclists.org)

                  PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                  darkuncle@infosec.exchangeD This user is from outside of this forum
                  darkuncle@infosec.exchangeD This user is from outside of this forum
                  darkuncle@infosec.exchange
                  wrote last edited by
                  #8

                  @lcamtuf very much a Chesterton's Fence kind of situation

                  1 Reply Last reply
                  0
                  • chuckmcmanis@chaos.socialC chuckmcmanis@chaos.social

                    @lcamtuf mumble, mumble, Chesterson's Fence, mumble, mumble

                    darkuncle@infosec.exchangeD This user is from outside of this forum
                    darkuncle@infosec.exchangeD This user is from outside of this forum
                    darkuncle@infosec.exchange
                    wrote last edited by
                    #9

                    @ChuckMcManis @lcamtuf came to say this, you beat me to it, well done

                    chuckmcmanis@chaos.socialC 1 Reply Last reply
                    0
                    • R relay@relay.publicsquare.global shared this topic
                    • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                      The coreutils Rust rewrite story is pretty funny.

                      Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                      But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                      Link Preview Image
                      oss-sec: uutils coreutils CVEs

                      favicon

                      (seclists.org)

                      PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                      migratory@jorts.horseM This user is from outside of this forum
                      migratory@jorts.horseM This user is from outside of this forum
                      migratory@jorts.horse
                      wrote last edited by
                      #10

                      @lcamtuf this is so funny and predictable because it's applying Rust in precisely the domain where it doesn't help: opaque, imperative side-effects in the global mutable state of the UNIX world of the filesystem and process tree

                      1 Reply Last reply
                      0
                      • darkuncle@infosec.exchangeD darkuncle@infosec.exchange

                        @ChuckMcManis @lcamtuf came to say this, you beat me to it, well done

                        chuckmcmanis@chaos.socialC This user is from outside of this forum
                        chuckmcmanis@chaos.socialC This user is from outside of this forum
                        chuckmcmanis@chaos.social
                        wrote last edited by
                        #11

                        @darkuncle @lcamtuf
                        During my tenure at Google I was astonished at how many engineers would clearly admit they didn't understand why something was the way it was, so they rewrote it. This *repeatedly* bit them in the ass.

                        darkuncle@infosec.exchangeD 1 Reply Last reply
                        0
                        • chuckmcmanis@chaos.socialC chuckmcmanis@chaos.social

                          @darkuncle @lcamtuf
                          During my tenure at Google I was astonished at how many engineers would clearly admit they didn't understand why something was the way it was, so they rewrote it. This *repeatedly* bit them in the ass.

                          darkuncle@infosec.exchangeD This user is from outside of this forum
                          darkuncle@infosec.exchangeD This user is from outside of this forum
                          darkuncle@infosec.exchange
                          wrote last edited by
                          #12

                          @ChuckMcManis @lcamtuf sometimes that's the only way to learn, but it's also often the most effective way to learn

                          1 Reply Last reply
                          0
                          • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                            The coreutils Rust rewrite story is pretty funny.

                            Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                            But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                            Link Preview Image
                            oss-sec: uutils coreutils CVEs

                            favicon

                            (seclists.org)

                            PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                            hyc@mastodon.socialH This user is from outside of this forum
                            hyc@mastodon.socialH This user is from outside of this forum
                            hyc@mastodon.social
                            wrote last edited by
                            #13

                            @lcamtuf See this all the time - people storm in trying to change things before trying to understand how the current things work. People who don't learn from what's been done before. Society doesn't progress from efforts like theirs. You only make progress by learning from and building on top of what came before.

                            synlogic4242@social.vivaldi.netS 1 Reply Last reply
                            0
                            • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                              The coreutils Rust rewrite story is pretty funny.

                              Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                              But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                              Link Preview Image
                              oss-sec: uutils coreutils CVEs

                              favicon

                              (seclists.org)

                              PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                              raymaccarthy@mastodon.ieR This user is from outside of this forum
                              raymaccarthy@mastodon.ieR This user is from outside of this forum
                              raymaccarthy@mastodon.ie
                              wrote last edited by
                              #14

                              @lcamtuf
                              I learned C++ after Modula-2 and before C.
                              I learned programming earlier.

                              Learning a programming language isn't learning programming (extracting requirements, specification, design, coding, test etc).
                              I looked at Rust. C++ certainly has got too complicated since 1987, but I wonder does Rust *only* help with memory safety?
                              Main memory safety in general relates to using pointers that are invalid, accessing arrays out of bounds and past the end of strings.
                              Partly bad libraries & design.

                              zardoz03@mastodon.onlineZ 1 Reply Last reply
                              0
                              • hyc@mastodon.socialH hyc@mastodon.social

                                @lcamtuf See this all the time - people storm in trying to change things before trying to understand how the current things work. People who don't learn from what's been done before. Society doesn't progress from efforts like theirs. You only make progress by learning from and building on top of what came before.

                                synlogic4242@social.vivaldi.netS This user is from outside of this forum
                                synlogic4242@social.vivaldi.netS This user is from outside of this forum
                                synlogic4242@social.vivaldi.net
                                wrote last edited by
                                #15

                                @hyc @lcamtuf ie. be like LEGO not Death Stars

                                1 Reply Last reply
                                0
                                • simonzerafa@infosec.exchangeS simonzerafa@infosec.exchange

                                  @lcamtuf

                                  Deus forbitbthey create a functional specification of how the existing utilities work, before converting / rewriting them in a new language 😟🤦‍♂️

                                  drwho@masto.hackers.townD This user is from outside of this forum
                                  drwho@masto.hackers.townD This user is from outside of this forum
                                  drwho@masto.hackers.town
                                  wrote last edited by
                                  #16

                                  @simonzerafa @lcamtuf Hahahahahah...

                                  Madness.

                                  1 Reply Last reply
                                  0
                                  • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                                    The coreutils Rust rewrite story is pretty funny.

                                    Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                                    But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                                    Link Preview Image
                                    oss-sec: uutils coreutils CVEs

                                    favicon

                                    (seclists.org)

                                    PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                                    lee_holmes@infosec.exchangeL This user is from outside of this forum
                                    lee_holmes@infosec.exchangeL This user is from outside of this forum
                                    lee_holmes@infosec.exchange
                                    wrote last edited by
                                    #17

                                    @lcamtuf Yeah, not a good situation - even doing it in "safe C++" or somesuch would have had the same result. Decades of hard-learned lessons should be encoded in decades of well-written unit tests.

                                    1 Reply Last reply
                                    0
                                    • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                                      The coreutils Rust rewrite story is pretty funny.

                                      Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                                      But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                                      Link Preview Image
                                      oss-sec: uutils coreutils CVEs

                                      favicon

                                      (seclists.org)

                                      PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                                      drwho@masto.hackers.townD This user is from outside of this forum
                                      drwho@masto.hackers.townD This user is from outside of this forum
                                      drwho@masto.hackers.town
                                      wrote last edited by
                                      #18

                                      @lcamtuf Welp. Got rent for next month covered.

                                      1 Reply Last reply
                                      0
                                      • pikhq@social.treehouse.systemsP pikhq@social.treehouse.systems

                                        @lcamtuf and it's very worth remembering that while the design of rust _does_ prevent many bugs, it's not a get-out-of-bugs-free card. there are many ways to write code wrong, not just memory safety issues!

                                        petrillic@hachyderm.ioP This user is from outside of this forum
                                        petrillic@hachyderm.ioP This user is from outside of this forum
                                        petrillic@hachyderm.io
                                        wrote last edited by
                                        #19

                                        @pikhq @lcamtuf @drwho we are, as a species, especially creative at finding new ways to write code wrong.

                                        1 Reply Last reply
                                        0
                                        • raymaccarthy@mastodon.ieR raymaccarthy@mastodon.ie

                                          @lcamtuf
                                          I learned C++ after Modula-2 and before C.
                                          I learned programming earlier.

                                          Learning a programming language isn't learning programming (extracting requirements, specification, design, coding, test etc).
                                          I looked at Rust. C++ certainly has got too complicated since 1987, but I wonder does Rust *only* help with memory safety?
                                          Main memory safety in general relates to using pointers that are invalid, accessing arrays out of bounds and past the end of strings.
                                          Partly bad libraries & design.

                                          zardoz03@mastodon.onlineZ This user is from outside of this forum
                                          zardoz03@mastodon.onlineZ This user is from outside of this forum
                                          zardoz03@mastodon.online
                                          wrote last edited by
                                          #20

                                          @raymaccarthy
                                          well allegedly its types are meant to aid in type driven design and better domain modelling; but i dont know if this is actually seen in practice in better code structure. same could be said of cxx + its classes
                                          @lcamtuf

                                          raymaccarthy@mastodon.ieR 1 Reply Last reply
                                          0
                                          Reply
                                          • Reply as topic
                                          Log in to reply
                                          • Oldest to Newest
                                          • Newest to Oldest
                                          • Most Votes


                                          • Login

                                          • Login or register to search.
                                          • First post
                                            Last post
                                          0
                                          • Categories
                                          • Recent
                                          • Tags
                                          • Popular
                                          • World
                                          • Users
                                          • Groups