242
Google's Shift to Rust Programming Cuts Android Memory Vulnerabilities by 52%
(thehackernews.com)
this post was submitted on 27 Sep 2024
242 points (98.0% liked)
Rust
5832 readers
5 users here now
Welcome to the Rust community! This is a place to discuss about the Rust programming language.
Wormhole
Credits
- The icon is a modified version of the official rust logo (changing the colors to a gradient and black background)
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It does not matter how much you teach, humans are not perfect. The industry changes all the time, everyone updates libraries, systems change, editing others code is not as easy to understand, and so on. There is a reason why Microsoft, Google and Linux have experts in their fields for decades and yet these mistakes happen.
And it makes sense why using Rust would reduce memory vulnerabilities. Because the language has features in place to either prevent or make those mistakes more difficult to happen. If you understand what Rust offers, then its not science to understand why. Google is not the first and only big company reporting this either.
It has been a couple of years now and the response to these articles is always the same. The person making the comment cannot accept that they produce code with bugs. So the problem has to be that the people being measured in the article must not know what they are doing.
Look at the source of these articles though. We are being asked to believe that the code in Android, Windows, AI frameworks, and databases are all being pumped out by junior devs. It is not that Rust results in fewer bugs than C++ generally, it is that Google engineers have not been properly trained or motivated.
I mean, the denial is Sith level strong in these people.
Why can't you believe that "these people" believe in both?
Though the "trained" part doesn't make as much sense as the "motivated" part.
That's 100% correct.
Those that don't care, will still not care.
Sure, I won't go around saying, "I don't make said mistakes". I too, tend to leave the destructors to be written later.
But that doesn't mean one can go on ignoring ignorance.
In my last project I had some database CRUD operations. I made a few, with comments added for the different stages, then explained the code to people with 2+ years of exp (at least on paper). They then went on to make the other functions using mine as a reference.
There were no memory safety issues in that, as there was no room for it. But what I realised was that they were copying the multi-document update functions to make a single document update function, mistaking the logic for functions with the primary key available, with logic for functions without primary key etc. Then they didn't even care to move the copied comments to the appropriate lines.
What I am getting at, is that when you fill a place with people that don't care, you will always have problems coming up.
That's your little bubble. I don't think its just not caring, its just super hard to write secure and correct code all the time. Especially writing operating systems such as Windows, Android and Linux Kernel in general is much different world. It's not like those engineers trying to code correctly since computers actually exist.
But lets assume you are correct and all of this comes down to people not caring. Why don't you get the job if you are really that good? I'm sure there are a few golden programmers like you, that the world would need. Or the industry adopts Rust (or a similar language) and have lot of security by default for free, for everyone. If its true what you are telling, then using such a language will make a difference.
And we are not speaking theoretically. There are metrics from Microsoft (and now from Google) which show improvements and advancements since Rust was adopted. But really, to say that those engineers and programmer don't care is just a wrong statement. Okay, you have no metrics to prove your point, but you are questioning reports from Google.
I can see you didn't care to understand the example I gave. Rust wouldn't have fixed the problem that happened in my bubble.
I can also see, you somehow think I am against Rust, just because I am for people caring about what they write.
No. I am interpreting the single number 52%, that came out of the report from Google, without caring about the meaning about the metric.
And that's what is causing you to not like what I wrote.
It's almost as if it is important to care about the context of what you are writing into. See what I did there?
And you didn't care what I wrote. Its not about your bubble and nobody cares what problem you had. You are bringing your argumentation in a topic up, where it does not apply. We are specifically talk about problems that Rust could help against. And you take your argumentation of your personal experience as a reason that people at Google, Microsoft and other big companies didn't want to learn and don't care.
And when I point it out, then it means people didn't care to understand your example.
Look, you can tell what you want, using and adopting Rust has real impact in writing and maintaining complex and important code that is secure. There are reports left and right. It's not hard to understand why Rust prevents or helps with these issues.
Your reply came out as, one that was trying to refute the claim of some anti-Rust comment. Which the previous comment was not.
The way Rust works, clearly shows that it was developed by people who cared about those things.
And just because something happened in my bubble, doesn't directly prove it to not be happening anywhere else, just because it doesn't prove otherwise.
Then why do you bring that up, after the argumentation that people did not want to learn? Look I try to be constructive. There are people who do not want to learn, but saying that all security issues is to attribute to that is wrong. Lot of the best engineers and programmers do their best, long time experts and groups, who still make mistakes.
What i"m saying is, that your example is not applicable in this discussion, because you are not writing systems programming for operating systems (such as Android or Windows or Linux), which are used by millions of people and ton of hackers try to find vulnerabilities. The best programmers in C and C++ make these mistakes that Rust would prevent (or make it much easier to find and eliminate).
That's the point. It's not about these experts not wanting to learn or not caring. We are not talking about the typical programmer for a website for company x or a fake game programmer for Android.