uecker

Somehow, magically, some people managed to write C software that I now use for three decade with not a single crash in all this time.

The C programs I use daily are generally very fast, very lean and very stable: Programs such as linux, terminals, shells, vim, etc.

I assume he means multi-dimensional arrays: std::array<std::array<int, 3>, 5> array_of_ints; int c_style_array[5][3]; But the C-style array is more readable, so I am not sure …

I think we agree on this. Fil-C does not ensure this. Showing the absence of run-time errors at compile-time is a hard problem, and the most realistic solution in general is via model checkers which I…

It certainly works in my C programs. And Fil-C demos imply that this also works for a lot of other complex real world programs, i.e. a basic Linux distribution with libreoffice on top... So yes, I wo…

Of course, I just wished enough Rust enthusiast cared also about other real-word security issues enough to get this fixed: https://rustup.rs/ …

Regarding the silly point: Fil-C is less of a rock than Safe Rust as everything in C just works. I am not sure about what you mean by "aborts regularly". After a memory safety issue, I think…

And 99% of the problem for memory safety and also any other issue goes away for the regular user if software is obtained from trusted sources that provide security support, because the window of oppor…

The percentage of fixed CVE at Microsoft is an irrelevant number. It is heavily biased by 1) what gets assigned a CVE in the first place (a usability issue or a weak supply chain usually does not even…

> C (where the safe subset is effectively empty), Well, Fil-C and also Cheri show that C is a language that can be implemented with perfect memory safety for 99.9% of the language. This is not true…

Most people I know that had security incidents did not have this because of memory safety issues. But it does not matter, even without memory safety issues out of the picture, you would need to update…

You can also simply wrap an int in a struct in C.

Splitting programs into mutually untrusting modules is a plausible alternative to memory safety in programming languages. Also in a program similar to qmail, memory safety alone is not sufficient, a l…

This is wrong as there are many other safety issues to worry about.

As a user you should be far more worried about running up-to-date software and supply chain risks rather than zero-days related to memory safety.

If we can all agree that my statement was true, there is no problem.

If you agree with that Rust sometimes has to add dynamic bounds check, then you could have just agreed with my original comment.

Rust does not do prevent all UB statically. Even if you guarantee at compile-time that all execution paths have well-defined semantics because compiler inserted run-time checks, this is not the same …

I like using C. It is simple, elegant, has very fast compilation times, requires no FFI needed for many libraries, is extremely stable and extremely portable, a large ecosystem, and, most importantly,…

A: "Rust prefers to prevent all undefined behavior statically" me: It does dynamic bounds checking. Rustaceans: But... for XYZ ... it doesn't... Sigh.

Rust fails to prove basic indirection to be statically safe and instead does a run-time check. fn main() { let v = vec![1, 2, 3]; v[5]; }

Maybe? I think my statement is clearly correct in the way I formulated it.

He claims the system provides memory safety under data races. Does it not?

I read "Rust prefers to prevent all undefined behavior statically," to also imply that it actually does this, because otherwise the word "all" would not make sense to me in this se…

I merely pointed out that the statement "Rust prefers to prevent all undefined behavior statically" is misleading in the sense that Rust does not do this for all undefined behavior.

Rust can not do this. But the original claim is that it is all statically checked in Rust, and this is an obvious counter example. Some dependently types languages can prove this statically, also mode…

These are not terribly interesting cases though, as it would also be impossible to get an oob access in other languages either.

Arguably the most important memory safety property, i.e. bounds checking for dynamic arrays, is also not statically checked in Rust.

Via remote attestation.

The website / service you want to use will not accept your key, but only the key from the organization that makes sure that your software does not make it possible to skip the ads. So I think the…