▲ 407 points
back
222 comments
Microsoft has been interested in using memory safe languages in the kernel for some time now. An example is the Midori project led by Joe Duffy back in 2009 which explored the idea with a C# derivative.
Rust is a game changer in that it is built from the ground up to offer memory safety without garbage collection and still aims for zero overhead abstractions.
It would be ironic, after their notorious security issues of the early 2000’s, if due to efforts like this, Microsoft Windows ends up being the most secure general operating system.
>Microsoft Windows ends up being the most secure general operating system
It already is. What, exactly, is better than Windows at security features on desktop computers? Linux? There is nothing in there that comes even close to the defensive features of windows, like HVCI, a subsystem that checks for driver signatures and the likes isolated by virtualization mechanisms, which completely prevents tempering with the kernel. Linux's support for secure boot only exists to make it convenient to dual boot with windows, it doesn't do enough to prevent kernel level rootkits, it's a total placebo and it's even worse if you use a distro that doesn't have signed kernels, like Archlinux. If you're self signing on the same computer, how exactly are you stopping malware?
Since Vista, the OS also gained some serious resilience against crashes that I have never seen on other operating systems. For example, it is possible for your desktop session to survive a GPU driver crash. On linux this is a guaranteed freeze or kernel panic. This is, fortunately, a rare event, but the last times I've seen my computer freeze on linux, it was always because of the graphic stack.
openBSD's slogan for having few remotely exploitable exploits out of the box doesn't mention that it's because it has literally no features enabled out of the box.
macOS and iOS are the systems with the greatest amount of privilege escalation fails by far. In fact, what do people think jailbreaks are? Some of which are truly frightening when you think about what could have been. Multiple jailbreaks were made that could be run just by browsing a webpage on safari. This means they punched through the browser, punched through privilege escalation and had the potential to install a rootkit on your phone. Just by visiting. A. Webpage.
How many times such a thing has happened on Windows in the recent years? visiting a webpage installed a rootkit on your computer?
> Rust is a game changer in that it is built from the ground up to offer memory safety without garbage collection and still aims for zero overhead abstractions.
Safe Rust cannot represent circular data structures which makes entire classes of algorithms and architectures unimplementable. You have to workaround these limitations by creating auxiliary structures for tracking references or use reference counting; neither are "zero overhead abstractions." Rust is only zero overhead if all you do is pass values up and down the call stack. Its false appeal says more about the simplistic types of applications folks are writing than anything else.
Project Midori was really good read, a lot of good stuff came from it
> Microsoft has been interested in using memory safe languages in the kernel for some time now. An example is the Midori project led by Joe Duffy back in 2009 which explored the idea with a C# derivative.
There is also Project Verona.
Well Linux is using Rust in the kernel too.
One of the slides lists:
> Has driven changes in upstream Rust: more try_ methods for Vec that don't panic in OOM: https://github.com/rust-lang/rust/pull/95051
I was curious to have a look at that PR, but it seems it was closed after a long discussion (mainly because it would add ~30% more methods to Vec?). So which changes landing in upstream Rust is the bullet point referring to? Was the Keyword Generics Initiative born out of this?
> (mainly because it would add ~30% more methods to Vec?)
Sort of. Rather than bolting on fallible methods adhoc to an existing type, it was felt it would be better to take a step back and actually design this properly. This includes third party crates experimenting with different options.
Maybe we should have a FallibleVec type? Maybe common vec-like methods could be abstracted out in to a `RawVec` type? Maybe both? Maybe the (unstable) `Allocator` API could be adapted to better suite all these cases? Whatever the case it's not great to be adding on a ton of methods in the heat of the moment.
They actually split these changes into their own crate I think:
Panicking on OOM was always a questionable design decision.
It doesn't always mean that your app has no memory, it just means that your chosen allocator has no free memory. That's not always an unrecoverable situation.
Link to the talk - https://www.youtube.com/watch?t=2611&v=8T6ClX-y2AE (timestamped to the part about Rust)
The speaker covers a bunch of areas and the final part of the talk (around 10 minutes) is about Microsoft introducing Rust in some self-contained areas in Windows.
Some highlights:
- Their focus is on "killing bug classes". More context in this post by Microsoft Research from 2019 - A proactive approach to more secure code.
- They want to do this with memory safe languages, CPU architectural changes and safer language subsets. This talk focussed on memory safe languages, specifically Rust.
- First area they've introduced Rust in - a cross platform rewrite of a font parser called DWriteCore. The team reported that parsing was "incredibly easy". Font shaping performance increased by 5-15% compared to the C++ version.
- It took about 2 devs working for half a year to complete this. The speaker says this is pretty good value for an area that is notorious for security bugs.
- Second area is the REGION data type in Win32k GDI. Currently in consumer Windows, disabled by feature flag. Will be enabled in insider builds soon. Performance has been good, some small wins for the Rust version.
- There is now a Windows SysCall implemented in completed safe Rust.
TLDR - Rust is inside the Windows Kernel, will be enabled widely soon.
> Font shaping performance increased by 5-15% compared to the C++ version.
Personally, I wouldn't link it directly to rust, but to rewriting. When you develop something, you usually can't account for all future changes that affect performance, design, LOC, robustness, and so on. But with rewrite, you take them all into account. So there is a big chance that rewrite will be superior in many areas. It will probably have the same effect as if they had rewritten it in C++ again.
Regarding fonts, I feel like when I modded my original Xbox as a teen, it was done using malicious font files on the hdd for the Xbox dashboard haha.
Note that this is high-level GUI stuff and GDI is only in the kernel due to old decisions made in the early 1990s (Windows NT 3.5).
Microsoft is busy rewriting core Windows library code in memory-safe Rust (theregister.com)
147 points by mikece 9 hours ago | flag | hide | past | favorite | 106 comments
> BlueHat IL 2023: Microsoft rewriting core Windows libraries in Rust (youtube.com)
89 points by mustache_kimono 23 hours ago | past | 45 comments
The primary source material is this talk: https://www.youtube.com/watch?v=8T6ClX-y2AE
I like writing C++ code, and I like using SAL annotations to try to improve safety. I try to remember to be const correct as best as I can. Is Rust something I would enjoy? It's hard to discern the signal from the noise on this lang
Maybe!
If you hate writing cmake/make/vcpkg/conan bs, and want to be able to git clone and build (almost) any project, without installing anything beyond rust+cargo... rust will be nice to use.
If you hate the idea of class hierarchies to try and describe behavior and would prefer to attach behavior to any type through traits... rust will be nice to use.
If you like the idea of having generics checking on said traits at compile time with sensible messages rather than the duck typed macros also termed templates with their horrendous error messages... rust will be nice to use
If you like the idea that the compiler verifies for you at compile time the concept of ownership while giving out references, ensuring 1 mutable reference and 0 immutable references, or N immutable references are allowed, while also ensuring the variable being referenced lives longer or as long as the references... rust will be nice to use
If you love spending time debugging invalid references/pointers, races, and more then rust isn't going to nice to use.
I think you will appreciate that moving objects actually invalidates the original bindings and the compiler checks for this quite effectively.
Though there is some learning curve..
Try it and see :)
I didn't find the syntax very ergonomic but then I'm the kinda guy that likes Python because it's so loose
I know this may seem an odd question, but what happens in a post rust world, when you NEED to exploit a system?
Such as say in 20 years when you want to be able to run custom code in a then old console.
Rust alone will not save you. Most of the gnarly exploits of late have been logic bugs.
Usually those who want to exploit the system and those building the system have very, very different goals in mind
As long as you have hardware access, you can fuck shit up in ways no software can ever prevent.
Not all exploits are possible because of software bugs: see e.g. https://free60.org/Hacks/Reset_Glitch_Hack/
Rust-ified Windows will still have the fundamental exploitable flaw of Windows - the ability to download binaries from anywhere and give them Admin privs
Attack the hardware: row hammer, jtag, rom swap, ...
You have to start thinking about it now: don't buy things to which you don't have open access. Lobby the politicians to make this happen if you care.
Why wasting time on this? Why not just spend the dev time on showing more ads?
One thing caught my eye:
96 KLOC of C++ is now 152 KLOC of Rust.
What causes the increase, and is that 1.5x ratio typical?
Since Microsoft developed the curious WinRT/Rust language projection, I've wondered if this would happen.
I mean, sure, it's useful anyway but still quite a niche product and was an oddly sudden dive into Rust from Microsoft at the time.
Now can we please get some basic customizations back, like the taskbar settings and the horrible rounded corners. Enough with apeing Apple
My concern is that Windows is already a massive dumpster fire of random bits and bobs. They haven't completed the migrations from the very earliest versions of Windows, they just increase the complexity at all points. The same is true of most of their major desktop apps including Visual Studio, which runs something like 30 processes just to have the main window running including a hotchpotch of EdgeView and Node js bits.
All this becomes is the xkcd trope of "this next migration will really fix our problems".
Unless they can genuinely replace more than 1 sub system in one go, they just increase complexity.
Best practice has always been to avoid kernel moisture, now they're actually shipping rusty kernels. shame
edit: wrong kind of rust
Gives a new meaning to the old idea of "Windows rot"
not that I've experienced that on Win10, which I found to be great.
This is "surprise" because Microsoft announced it?
It has been possible to use Rust to write device drivers that run on Windows kernel space for years, already.
The Windows-rs crate (Microsoft's crate wrapping the Windows API) already has the WDK for a while (i.e.: the special sdk to interact with the kernel).
I welcome the news and agree it is important and meaningful but it is the kind of thing that was easy to see coming.
Great. They’ll add bing ads into std.
Good decision, I love this game
Are they porting their acclaimed tabloid news service or does that stay in cpp?
HN (heart) Rust. Therefore HN (heart) Windows? That will be novel....
I just hope the Windows logo is bigger than the Rust logo...
Any good reason why or are they using Rust for brownie points
Windows kernel already had rust and now has Rust.
haha i wish Microsoft would just rebase Windows on Linux: extract the Windows "experience"(sic) into a UI/Desktop Environment for Linux and then bless some LTS of Linux as the underlying system and call it a day.
Of course they would never, ever do that, but I can hope however hopeless that is.
Dumb question, but isn’t Rust an awful name marketing wise? How did the language’s founders settle on it? Hopefully there’s a more interesting history than rust is a thin layer atop bare metal.
Nice try, Microsoft. You'll need to do more than just use more Rust to get me to downgrade to Windows 11.