Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Brite
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (Cyborg)
  • No Skin
Collapse
Brand Logo

CIRCLE WITH A DOT

  1. Home
  2. Uncategorized
  3. The coreutils Rust rewrite story is pretty funny.

The coreutils Rust rewrite story is pretty funny.

Scheduled Pinned Locked Moved Uncategorized
47 Posts 27 Posters 173 Views
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • hyc@mastodon.socialH hyc@mastodon.social

    @lcamtuf See this all the time - people storm in trying to change things before trying to understand how the current things work. People who don't learn from what's been done before. Society doesn't progress from efforts like theirs. You only make progress by learning from and building on top of what came before.

    synlogic4242@social.vivaldi.netS This user is from outside of this forum
    synlogic4242@social.vivaldi.netS This user is from outside of this forum
    synlogic4242@social.vivaldi.net
    wrote last edited by
    #15

    @hyc @lcamtuf ie. be like LEGO not Death Stars

    1 Reply Last reply
    0
    • simonzerafa@infosec.exchangeS simonzerafa@infosec.exchange

      @lcamtuf

      Deus forbitbthey create a functional specification of how the existing utilities work, before converting / rewriting them in a new language 😟🤦‍♂️

      drwho@masto.hackers.townD This user is from outside of this forum
      drwho@masto.hackers.townD This user is from outside of this forum
      drwho@masto.hackers.town
      wrote last edited by
      #16

      @simonzerafa @lcamtuf Hahahahahah...

      Madness.

      1 Reply Last reply
      0
      • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

        The coreutils Rust rewrite story is pretty funny.

        Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

        But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

        Link Preview Image
        oss-sec: uutils coreutils CVEs

        favicon

        (seclists.org)

        PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

        lee_holmes@infosec.exchangeL This user is from outside of this forum
        lee_holmes@infosec.exchangeL This user is from outside of this forum
        lee_holmes@infosec.exchange
        wrote last edited by
        #17

        @lcamtuf Yeah, not a good situation - even doing it in "safe C++" or somesuch would have had the same result. Decades of hard-learned lessons should be encoded in decades of well-written unit tests.

        1 Reply Last reply
        0
        • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

          The coreutils Rust rewrite story is pretty funny.

          Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

          But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

          Link Preview Image
          oss-sec: uutils coreutils CVEs

          favicon

          (seclists.org)

          PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

          drwho@masto.hackers.townD This user is from outside of this forum
          drwho@masto.hackers.townD This user is from outside of this forum
          drwho@masto.hackers.town
          wrote last edited by
          #18

          @lcamtuf Welp. Got rent for next month covered.

          1 Reply Last reply
          0
          • pikhq@social.treehouse.systemsP pikhq@social.treehouse.systems

            @lcamtuf and it's very worth remembering that while the design of rust _does_ prevent many bugs, it's not a get-out-of-bugs-free card. there are many ways to write code wrong, not just memory safety issues!

            petrillic@hachyderm.ioP This user is from outside of this forum
            petrillic@hachyderm.ioP This user is from outside of this forum
            petrillic@hachyderm.io
            wrote last edited by
            #19

            @pikhq @lcamtuf @drwho we are, as a species, especially creative at finding new ways to write code wrong.

            1 Reply Last reply
            0
            • raymaccarthy@mastodon.ieR raymaccarthy@mastodon.ie

              @lcamtuf
              I learned C++ after Modula-2 and before C.
              I learned programming earlier.

              Learning a programming language isn't learning programming (extracting requirements, specification, design, coding, test etc).
              I looked at Rust. C++ certainly has got too complicated since 1987, but I wonder does Rust *only* help with memory safety?
              Main memory safety in general relates to using pointers that are invalid, accessing arrays out of bounds and past the end of strings.
              Partly bad libraries & design.

              zardoz03@mastodon.onlineZ This user is from outside of this forum
              zardoz03@mastodon.onlineZ This user is from outside of this forum
              zardoz03@mastodon.online
              wrote last edited by
              #20

              @raymaccarthy
              well allegedly its types are meant to aid in type driven design and better domain modelling; but i dont know if this is actually seen in practice in better code structure. same could be said of cxx + its classes
              @lcamtuf

              raymaccarthy@mastodon.ieR 1 Reply Last reply
              0
              • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                The coreutils Rust rewrite story is pretty funny.

                Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                Link Preview Image
                oss-sec: uutils coreutils CVEs

                favicon

                (seclists.org)

                PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                m@martinh.netM This user is from outside of this forum
                m@martinh.netM This user is from outside of this forum
                m@martinh.net
                wrote last edited by
                #21

                @lcamtuf Et tu, TOCTOU

                1 Reply Last reply
                0
                • xerz@soc.masfloss.netX xerz@soc.masfloss.net

                  @lcamtuf ........ouch

                  I'm shocked they didn't account for any of that

                  hypha@cafe.mycelium.locahlo.stH This user is from outside of this forum
                  hypha@cafe.mycelium.locahlo.stH This user is from outside of this forum
                  hypha@cafe.mycelium.locahlo.st
                  wrote last edited by
                  #22

                  @xerz @lcamtuf it’s easy to fall for domain specific knowledge traps when you’re learning
                  which is why it’s often advised against rewriting software from scratch, especially if you were not in the first team of developers

                  1 Reply Last reply
                  0
                  • zardoz03@mastodon.onlineZ zardoz03@mastodon.online

                    @raymaccarthy
                    well allegedly its types are meant to aid in type driven design and better domain modelling; but i dont know if this is actually seen in practice in better code structure. same could be said of cxx + its classes
                    @lcamtuf

                    raymaccarthy@mastodon.ieR This user is from outside of this forum
                    raymaccarthy@mastodon.ieR This user is from outside of this forum
                    raymaccarthy@mastodon.ie
                    wrote last edited by
                    #23

                    @zardoz03 @lcamtuf
                    Strong types help, but loads of languages had that 40 years ago.

                    1 Reply Last reply
                    0
                    • synlogic4242@social.vivaldi.netS synlogic4242@social.vivaldi.net

                      @lcamtuf Rustaceans are the problem, not Rust itself. theyre like a lobbing group trying explicitly to boost their future employment demand much more than prioritized on doing the right thing as engineers or for the community. much like the AI VC are "talking up their book" even if its poison for the rest of us

                      rmq@toot.ioR This user is from outside of this forum
                      rmq@toot.ioR This user is from outside of this forum
                      rmq@toot.io
                      wrote last edited by
                      #24

                      @synlogic4242 Uutils started as someone’s personal project to learn rust, and “write a system utility” is frequently used as a basic exercise for learning. Uutils is doing exactly what it set out to do.

                      It’s not the fault of uutils that Canonical is dumb.

                      @lcamtuf

                      synlogic4242@social.vivaldi.netS 1 Reply Last reply
                      0
                      • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                        The coreutils Rust rewrite story is pretty funny.

                        Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                        But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                        Link Preview Image
                        oss-sec: uutils coreutils CVEs

                        favicon

                        (seclists.org)

                        PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                        klausman@mas.toK This user is from outside of this forum
                        klausman@mas.toK This user is from outside of this forum
                        klausman@mas.to
                        wrote last edited by
                        #25

                        @lcamtuf There's also that human habit of getting complacent about all bugs when _some_ types of bugs are either impossible or very very hard to make because of language structure and tooling.

                        1 Reply Last reply
                        0
                        • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                          The coreutils Rust rewrite story is pretty funny.

                          Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                          But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                          Link Preview Image
                          oss-sec: uutils coreutils CVEs

                          favicon

                          (seclists.org)

                          PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                          groxx@hachyderm.ioG This user is from outside of this forum
                          groxx@hachyderm.ioG This user is from outside of this forum
                          groxx@hachyderm.io
                          wrote last edited by
                          #26

                          @lcamtuf a related observation would probably be: why did important, security-critical edge cases get handled without enough documentation to prevent them from reoccurring?

                          1 Reply Last reply
                          0
                          • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                            The coreutils Rust rewrite story is pretty funny.

                            Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                            But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                            Link Preview Image
                            oss-sec: uutils coreutils CVEs

                            favicon

                            (seclists.org)

                            PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                            arcaik@hachyderm.ioA This user is from outside of this forum
                            arcaik@hachyderm.ioA This user is from outside of this forum
                            arcaik@hachyderm.io
                            wrote last edited by
                            #27

                            @lcamtuf Why do we keep calling uutils coreutils a rewrite?

                            1 Reply Last reply
                            0
                            • rmq@toot.ioR rmq@toot.io

                              @synlogic4242 Uutils started as someone’s personal project to learn rust, and “write a system utility” is frequently used as a basic exercise for learning. Uutils is doing exactly what it set out to do.

                              It’s not the fault of uutils that Canonical is dumb.

                              @lcamtuf

                              synlogic4242@social.vivaldi.netS This user is from outside of this forum
                              synlogic4242@social.vivaldi.netS This user is from outside of this forum
                              synlogic4242@social.vivaldi.net
                              wrote last edited by
                              #28

                              @rmq @lcamtuf I view it as both their fault. I'm pissed that after having to deal with Copy.Fail I now have to wipe other people's butts again for them. and I worry this will happen with more frequency as more vibe-coded software spreads around

                              1 Reply Last reply
                              0
                              • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                                The coreutils Rust rewrite story is pretty funny.

                                Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                                But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                                Link Preview Image
                                oss-sec: uutils coreutils CVEs

                                favicon

                                (seclists.org)

                                PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                                E This user is from outside of this forum
                                E This user is from outside of this forum
                                equity7804@hostux.social
                                wrote last edited by
                                #29

                                @lcamtuf Hey, would you care to elaborate or point me to resources explaining why the coreutils aren't fertile ground for memory safety issues? It's the first time I heard of this

                                1 Reply Last reply
                                0
                                • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                                  The coreutils Rust rewrite story is pretty funny.

                                  Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                                  But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                                  Link Preview Image
                                  oss-sec: uutils coreutils CVEs

                                  favicon

                                  (seclists.org)

                                  PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                                  sten@chaos.socialS This user is from outside of this forum
                                  sten@chaos.socialS This user is from outside of this forum
                                  sten@chaos.social
                                  wrote last edited by
                                  #30

                                  @lcamtuf Not only that, some of the utils were not command line-compatible with their non-Rust counterparts.

                                  Honestly, I don't understand why these utils were rewritten. They didn't need rewriting.

                                  1 Reply Last reply
                                  0
                                  • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                                    The coreutils Rust rewrite story is pretty funny.

                                    Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                                    But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                                    Link Preview Image
                                    oss-sec: uutils coreutils CVEs

                                    favicon

                                    (seclists.org)

                                    PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                                    ireneista@adhd.irenes.spaceI This user is from outside of this forum
                                    ireneista@adhd.irenes.spaceI This user is from outside of this forum
                                    ireneista@adhd.irenes.space
                                    wrote last edited by
                                    #31

                                    @lcamtuf yeah it's frustrating because in some sense we all had the opportunity to learn this lesson, a long time ago

                                    we remember when we were kids, after Netscape went bankrupt trying to re-write their software from scratch, there were some good essays analyzing what went wrong and advocating for refactoring instead so as not to lose the knowledge that's in the code

                                    and then there's the ATC system

                                    like... there's so many past instances to learn from

                                    ireneista@adhd.irenes.spaceI 1 Reply Last reply
                                    0
                                    • ireneista@adhd.irenes.spaceI ireneista@adhd.irenes.space

                                      @lcamtuf yeah it's frustrating because in some sense we all had the opportunity to learn this lesson, a long time ago

                                      we remember when we were kids, after Netscape went bankrupt trying to re-write their software from scratch, there were some good essays analyzing what went wrong and advocating for refactoring instead so as not to lose the knowledge that's in the code

                                      and then there's the ATC system

                                      like... there's so many past instances to learn from

                                      ireneista@adhd.irenes.spaceI This user is from outside of this forum
                                      ireneista@adhd.irenes.spaceI This user is from outside of this forum
                                      ireneista@adhd.irenes.space
                                      wrote last edited by
                                      #32

                                      @lcamtuf and then there's... well, there's a persistent feeling that starting over without regard for the past will make things better, rather than just repeating the same fundamental mistake that happened the first time

                                      we've felt it too. it's a powerful pull.

                                      we wrote a bit about that feeling, a while back https://irenes.space/leaves/2024-09-29-technology-community-idealism

                                      doomed_daniel@mastodon.gamedev.placeD 1 Reply Last reply
                                      0
                                      • ireneista@adhd.irenes.spaceI ireneista@adhd.irenes.space

                                        @lcamtuf and then there's... well, there's a persistent feeling that starting over without regard for the past will make things better, rather than just repeating the same fundamental mistake that happened the first time

                                        we've felt it too. it's a powerful pull.

                                        we wrote a bit about that feeling, a while back https://irenes.space/leaves/2024-09-29-technology-community-idealism

                                        doomed_daniel@mastodon.gamedev.placeD This user is from outside of this forum
                                        doomed_daniel@mastodon.gamedev.placeD This user is from outside of this forum
                                        doomed_daniel@mastodon.gamedev.place
                                        wrote last edited by
                                        #33

                                        @ireneista @lcamtuf
                                        I guess that could work if you really investigate all the fundamental mistakes, as well as the regular bugs/pitfalls, from the first time and try your best to avoid them.

                                        Assuming that "it was written in a less safe language" was the only or even most important issue is.. not that useful

                                        ireneista@adhd.irenes.spaceI 1 Reply Last reply
                                        0
                                        • doomed_daniel@mastodon.gamedev.placeD doomed_daniel@mastodon.gamedev.place

                                          @ireneista @lcamtuf
                                          I guess that could work if you really investigate all the fundamental mistakes, as well as the regular bugs/pitfalls, from the first time and try your best to avoid them.

                                          Assuming that "it was written in a less safe language" was the only or even most important issue is.. not that useful

                                          ireneista@adhd.irenes.spaceI This user is from outside of this forum
                                          ireneista@adhd.irenes.spaceI This user is from outside of this forum
                                          ireneista@adhd.irenes.space
                                          wrote last edited by
                                          #34

                                          @Doomed_Daniel @lcamtuf yeah, exactly

                                          ireneista@adhd.irenes.spaceI 1 Reply Last reply
                                          0
                                          Reply
                                          • Reply as topic
                                          Log in to reply
                                          • Oldest to Newest
                                          • Newest to Oldest
                                          • Most Votes


                                          • Login

                                          • Login or register to search.
                                          • First post
                                            Last post
                                          0
                                          • Categories
                                          • Recent
                                          • Tags
                                          • Popular
                                          • World
                                          • Users
                                          • Groups