<![CDATA[The coreutils Rust rewrite story is pretty funny.]]>The coreutils Rust rewrite story is pretty funny.

Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

Link Preview Image
oss-sec: uutils coreutils CVEs

favicon

(seclists.org)

PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

]]>https://board.circlewithadot.net/topic/f25b273c-9d08-4a17-9e4f-862aeae1d31a/the-coreutils-rust-rewrite-story-is-pretty-funny.RSS for NodeMon, 25 May 2026 02:24:28 GMTMon, 04 May 2026 16:14:48 GMT60<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 21:07:03 GMT]]>@puppygirlhornypost2@transfem.social @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@irenes.space it is . it ships many commands that coreutils does , but its a completely indipendent implementation .

]]>https://board.circlewithadot.net/post/https://brain.worm.pink/objects/f77fdc4b-51d7-42b6-be6a-af7b5b16a866https://board.circlewithadot.net/post/https://brain.worm.pink/objects/f77fdc4b-51d7-42b6-be6a-af7b5b16a866Mon, 04 May 2026 21:07:03 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 21:06:17 GMT]]>@ireneista@adhd.irenes.space @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place I thought it was entirely independent from gnu coreutils.

]]>https://board.circlewithadot.net/post/https://transfem.social/notes/alv97a7jgjav0gikhttps://board.circlewithadot.net/post/https://transfem.social/notes/alv97a7jgjav0gikMon, 04 May 2026 21:06:17 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 21:03:29 GMT]]>@puppygirlhornypost2@transfem.social @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@irenes.space yep . if you wanna run stuff in containers , theres little to no point to use something other than alpine as a container base .

]]>https://board.circlewithadot.net/post/https://brain.worm.pink/objects/ddc48da5-5a5d-47ba-9f14-bdbb95ae2492https://board.circlewithadot.net/post/https://brain.worm.pink/objects/ddc48da5-5a5d-47ba-9f14-bdbb95ae2492Mon, 04 May 2026 21:03:29 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 21:00:51 GMT]]>@fiore@brain.worm.pink @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@adhd.irenes.space iirc busybox is often used in initramfs and other light environments like containers. I mean, on my Gentoo desktop, I have the busybox module installed for dracut, so it's packed into my initramfs... but also that's not something that's default with the distribution.

]]>https://board.circlewithadot.net/post/https://transfem.social/notes/alv90a3b6m0m09hbhttps://board.circlewithadot.net/post/https://transfem.social/notes/alv90a3b6m0m09hbMon, 04 May 2026 21:00:51 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 20:57:42 GMT]]>@fiore@brain.worm.pink @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@adhd.irenes.space I mean there's "alternative" and then there's "drop in replacement". I guess that was a linguistic issue on my part. I did not mean to imply busybox is supposed to be a remake of gnu coreutils. Some commands/programs/whatever (the windows sysadmin in me wants to say commandlets lol) of coreutils such as shuf are not available on busybox. I do see it advertised as a light weight alternative to gnu coreutils in server applications. Specifically when you don't need GNU coreutils-specific features

]]>https://board.circlewithadot.net/post/https://transfem.social/notes/alv8w8eqm9id022bhttps://board.circlewithadot.net/post/https://transfem.social/notes/alv8w8eqm9id022bMon, 04 May 2026 20:57:42 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 20:55:54 GMT]]>@puppygirlhornypost2@transfem.social @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@irenes.space busybox is not an alternative to gnu coreutils , it doesnt care to be coreutils compatible .. uutils does (for some reason??)

]]>https://board.circlewithadot.net/post/https://brain.worm.pink/objects/aa190c03-3b5a-4cd8-a4da-8db5484a6d79https://board.circlewithadot.net/post/https://brain.worm.pink/objects/aa190c03-3b5a-4cd8-a4da-8db5484a6d79Mon, 04 May 2026 20:55:54 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 20:54:20 GMT]]>@puppygirlhornypost2 @lcamtuf @Doomed_Daniel ... wait, is BusyBox an alternative? we thought it was the same coreutils, just bundled in a single executable for deployment reasons?

]]>https://board.circlewithadot.net/post/https://adhd.irenes.space/users/ireneista/statuses/01KQTCAFQT8HX0VF3NQQHNGZB0https://board.circlewithadot.net/post/https://adhd.irenes.space/users/ireneista/statuses/01KQTCAFQT8HX0VF3NQQHNGZB0Mon, 04 May 2026 20:54:20 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 20:53:33 GMT]]>@Doomed_Daniel@mastodon.gamedev.place @lcamtuf@infosec.exchange @ireneista@adhd.irenes.space I think you mistook musl for BusyBox. I did the same thing in my head. (musl is an MIT-licensed C standard library implementation) It appears BusyBox (alternative to gnu coreutils) is also licensed under GPLv2, unfortunately.

]]>https://board.circlewithadot.net/post/https://transfem.social/notes/alv8qw36qauk0fi8https://board.circlewithadot.net/post/https://transfem.social/notes/alv8qw36qauk0fi8Mon, 04 May 2026 20:53:33 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 20:51:49 GMT]]>@puppygirlhornypost2 @lcamtuf @ireneista
sure, but needs more people, and some of them won't get to do the fun part (writing new code)

they could've looked at musl though, I assume it does not have the same bugs (but am too lazy to check)

]]>https://board.circlewithadot.net/post/https://mastodon.gamedev.place/users/Doomed_Daniel/statuses/116518283467922305https://board.circlewithadot.net/post/https://mastodon.gamedev.place/users/Doomed_Daniel/statuses/116518283467922305Mon, 04 May 2026 20:51:49 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 20:50:51 GMT]]>@ireneista@adhd.irenes.space @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place Well there's always the ability for clean room implementation, no?

]]>https://board.circlewithadot.net/post/https://transfem.social/notes/alv8nft9d88z09c3https://board.circlewithadot.net/post/https://transfem.social/notes/alv8nft9d88z09c3Mon, 04 May 2026 20:50:51 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 20:43:22 GMT]]>@Doomed_Daniel @lcamtuf ouch. welp.

]]>https://board.circlewithadot.net/post/https://adhd.irenes.space/users/ireneista/statuses/01KQTBPCJ72ET6E7YVQ5D2G14Thttps://board.circlewithadot.net/post/https://adhd.irenes.space/users/ireneista/statuses/01KQTBPCJ72ET6E7YVQ5D2G14TMon, 04 May 2026 20:43:22 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 20:41:53 GMT]]>@ireneista @lcamtuf
Additional fun thought: I can imagine they avoided looking at the GNU coreutils C implementation because they are using MIT license instead of GPL.

]]>https://board.circlewithadot.net/post/https://mastodon.gamedev.place/users/Doomed_Daniel/statuses/116518244437405723https://board.circlewithadot.net/post/https://mastodon.gamedev.place/users/Doomed_Daniel/statuses/116518244437405723Mon, 04 May 2026 20:41:53 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 20:14:11 GMT]]>@Doomed_Daniel @lcamtuf we firmly believe, for ourselves, that code is communication

and one very big thing it's communicating is: hey, future maintainer, this detail is important

]]>https://board.circlewithadot.net/post/https://adhd.irenes.space/users/ireneista/statuses/01KQTA0ZAQTHNN1NCYSM1ADS7Shttps://board.circlewithadot.net/post/https://adhd.irenes.space/users/ireneista/statuses/01KQTA0ZAQTHNN1NCYSM1ADS7SMon, 04 May 2026 20:14:11 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 20:13:38 GMT]]>@Doomed_Daniel @lcamtuf yeah, exactly

]]>https://board.circlewithadot.net/post/https://adhd.irenes.space/users/ireneista/statuses/01KQT9ZYZYCND00CDCWTH6DR02https://board.circlewithadot.net/post/https://adhd.irenes.space/users/ireneista/statuses/01KQT9ZYZYCND00CDCWTH6DR02Mon, 04 May 2026 20:13:38 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 20:06:13 GMT]]>@ireneista @lcamtuf
I guess that could work if you really investigate all the fundamental mistakes, as well as the regular bugs/pitfalls, from the first time and try your best to avoid them.

Assuming that "it was written in a less safe language" was the only or even most important issue is.. not that useful

]]>https://board.circlewithadot.net/post/https://mastodon.gamedev.place/users/Doomed_Daniel/statuses/116518104147608713https://board.circlewithadot.net/post/https://mastodon.gamedev.place/users/Doomed_Daniel/statuses/116518104147608713Mon, 04 May 2026 20:06:13 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 19:56:11 GMT]]>@lcamtuf and then there's... well, there's a persistent feeling that starting over without regard for the past will make things better, rather than just repeating the same fundamental mistake that happened the first time

we've felt it too. it's a powerful pull.

we wrote a bit about that feeling, a while back https://irenes.space/leaves/2024-09-29-technology-community-idealism

]]>https://board.circlewithadot.net/post/https://adhd.irenes.space/users/ireneista/statuses/01KQT900TAYF0WDH0RHQNZMT6Whttps://board.circlewithadot.net/post/https://adhd.irenes.space/users/ireneista/statuses/01KQT900TAYF0WDH0RHQNZMT6WMon, 04 May 2026 19:56:11 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 19:49:48 GMT]]>@lcamtuf yeah it's frustrating because in some sense we all had the opportunity to learn this lesson, a long time ago

we remember when we were kids, after Netscape went bankrupt trying to re-write their software from scratch, there were some good essays analyzing what went wrong and advocating for refactoring instead so as not to lose the knowledge that's in the code

and then there's the ATC system

like... there's so many past instances to learn from

]]>https://board.circlewithadot.net/post/https://adhd.irenes.space/users/ireneista/statuses/01KQT8MA1MC610Y46TSJSVW89Zhttps://board.circlewithadot.net/post/https://adhd.irenes.space/users/ireneista/statuses/01KQT8MA1MC610Y46TSJSVW89ZMon, 04 May 2026 19:49:48 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 18:14:59 GMT]]>@lcamtuf Not only that, some of the utils were not command line-compatible with their non-Rust counterparts.

Honestly, I don't understand why these utils were rewritten. They didn't need rewriting.

]]>https://board.circlewithadot.net/post/https://chaos.social/users/sten/statuses/116517666758607667https://board.circlewithadot.net/post/https://chaos.social/users/sten/statuses/116517666758607667Mon, 04 May 2026 18:14:59 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 17:53:26 GMT]]>@lcamtuf Hey, would you care to elaborate or point me to resources explaining why the coreutils aren't fertile ground for memory safety issues? It's the first time I heard of this

]]>https://board.circlewithadot.net/post/https://hostux.social/users/Equity7804/statuses/116517582014371253https://board.circlewithadot.net/post/https://hostux.social/users/Equity7804/statuses/116517582014371253Mon, 04 May 2026 17:53:26 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 17:47:22 GMT]]>@rmq @lcamtuf I view it as both their fault. I'm pissed that after having to deal with Copy.Fail I now have to wipe other people's butts again for them. and I worry this will happen with more frequency as more vibe-coded software spreads around

]]>https://board.circlewithadot.net/post/https://social.vivaldi.net/users/synlogic4242/statuses/116517558199221998https://board.circlewithadot.net/post/https://social.vivaldi.net/users/synlogic4242/statuses/116517558199221998Mon, 04 May 2026 17:47:22 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 17:47:12 GMT]]>@lcamtuf Why do we keep calling uutils coreutils a rewrite?

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/Arcaik/statuses/116517557555475069https://board.circlewithadot.net/post/https://hachyderm.io/users/Arcaik/statuses/116517557555475069Mon, 04 May 2026 17:47:12 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 17:39:10 GMT]]>@lcamtuf a related observation would probably be: why did important, security-critical edge cases get handled without enough documentation to prevent them from reoccurring?

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/groxx/statuses/116517525924590853https://board.circlewithadot.net/post/https://hachyderm.io/users/groxx/statuses/116517525924590853Mon, 04 May 2026 17:39:10 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 17:34:24 GMT]]>@lcamtuf There's also that human habit of getting complacent about all bugs when _some_ types of bugs are either impossible or very very hard to make because of language structure and tooling.

]]>https://board.circlewithadot.net/post/https://mas.to/users/klausman/statuses/116517507223196605https://board.circlewithadot.net/post/https://mas.to/users/klausman/statuses/116517507223196605Mon, 04 May 2026 17:34:24 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Mon, 04 May 2026 17:32:30 GMT]]>@synlogic4242 Uutils started as someone’s personal project to learn rust, and “write a system utility” is frequently used as a basic exercise for learning. Uutils is doing exactly what it set out to do.

It’s not the fault of uutils that Canonical is dumb.

@lcamtuf

]]>https://board.circlewithadot.net/post/https://toot.io/users/rmq/statuses/116517499750266566https://board.circlewithadot.net/post/https://toot.io/users/rmq/statuses/116517499750266566Mon, 04 May 2026 17:32:30 GMT