uecker

Rust as a language is not relevant, but the Rust community still helped to popularize the idea that trashing a community by a rewrite is ok if it serves some "higher goal". This rewrite is j…

I assume it is meant to not only have hashes of the final output, but also securely record all steps done by the right people and the right inputs during building of the software. But this solves the…

1. What would this be? 2. Good point, but for most purposes I think exploiting some aspect of the build system or the language that moves the exploit code or causes it to be executed before main would…

For this to be useful you would need to modify the compiler binary to make the exploit persistent. Otherwise why put an exploit for the compiler in the source to so that the compiler can put some ma…

The aspects where I think Rust is worse are: compilation time, high complexity, less stable, only one implementation, no international standard, no proper ABI. xz was a highly sophisticated attack us…

Rust is not a lot better than C. In many aspect, it is worse. It is better if you focus on a specific point (memory safety) and exaggerate its importance beyond all other considerations and ignoring a…

Also waypipe is inferior by design as it is a proxy added after the fact. But it does not matter that they now have some kind of a solution for a use case for which they denied that it even exists for…

Not much, and people also should not to do this. One should at least have a check of hash of the download vs some document signed with a key. In any case, the curl|bash from a website is way worse as…

And all the gaslighting. Using X forward basically every day but being told it is useless and broken and nobody needs it...

The better choice would have been to double down on N9 and successors. This was my opinion at that time and still is. You may be right about all the internal problems that delayed thing, but the Wind…

"But the N9’s accolades did not ultimately carry the day. " I think it would have. The N9 was killed before it came to market. It was never sold in any of the major markets, the platform was…

I think Rust is annoyingly complex and badly designed (although it has good parts) and this would be the same mistake as past pushs to move projects to C++ because "object orientation is clearly …

Not really, there a lot of factors making nuclear expensive apart from regulations. And is also clear that you need some regulations.

This is nonsense. There is quite a subset of C which is perfectly safe and an even larger one which can easily be safe with tooling. You could argue that unsafe keyword is easier to spot than the unsa…

Or Rust, when not sticking exclusively to safe Rust, but this is not really possible in many systems programming scenarious.

Ok, you are right. There are situation where something should be re-designed from scratch. I am also not against building something new or better alternatives. But I would still argue that far more…

Exactly. Nothing which should exist.

Sorry, I think the idea that rewrites are good way to achieve more maintenable software is basically always based on a delusion. It is a very common and well understood delusion for programmers who al…

I don't think this is what we want. We want people to maintain and incrementally improve existing software and tooling and not rewrite and change things all the time.

A long time ago, I also thought one should use unsigned mostly but I am now in the opposite camp. Unsigned integers in C have semantics for modulo arithmetic. They are suitable if you need this, so fo…

Because it is not trustworthy, which is really the most important thing.

I do not keep track of them, but google finds CrateDepression, faster_log, async_println, finch-rust or recently: https://cybersecuritynews.com/supply-chain-trapdoor-malware/ It …

Of course, the point was that it is not a great step forward in software engineering but zig catching up to what was is a reasonable design.

I think there were enough attacks already for cargo that one can not call this FUD. It is also obvious that this way to distribute software is susceptible to supply chain attacks. cargo audit is an at…

I would agree that the zig developers know what they are doing. But not necessarily all fans of the language...

It is exactly because software is a social activity that one should try to understand the purpose of a design before changing it.

Fair, but with all the new C-alternative languages I also see a lot of Chesterton's Fences being teared down. In part, this is also perfectly fine for experimentation, but sometimes it leaves me…

On the other hand, systems like cargo a clearly a supply chain disaster. I also think that languages should not have their own specific packaging system. This should be done on a distribution level, w…

It was a resounding endorsement in 2020, but the proof is in the pudding. So far I am not impressed. It is also not something I think is terribly important. Even if they managed to improve memory saf…

I wonder whether the "replacing c in the linux kernel" is not more wishful thinking by Rust enthusiasts. As of know it has less than 1% and less than bash.