[timschmidt]

Microsoft: 70% of all security bugs are memory safety issues: https://www.zdnet.com/article/microsoft-70-percent-of-all-se...

Chrome: 70% of all security bugs are memory safety issues: https://www.zdnet.com/article/chrome-70-of-all-security-bugs...

"Rust is an emerging programing language that aims at preventing memory-safety bugs without sacrificing much efficiency. The claimed property is very attractive to developers, and many projects start using the language. However, can Rust achieve the memory-safety promise? This paper studies the question by surveying 186 real-world bug reports collected from several origins which contain all existing Rust CVEs (common vulnerability and exposures) of memory-safety issues by 2020-12-31. We manually analyze each bug and extract their culprit patterns. Our analysis result shows that Rust can keep its promise that all memory-safety bugs require unsafe code...": https://arxiv.org/abs/2003.03296

Seems persuasive to me.

[JohnFen]

As I said, there is some merit to the argument. I do think that it's stretched a bit far, but that's neither here nor there. In any case, I'm not saying I'm opposed to applications being written in Rust. Use the language that suits your needs the best. All I'm saying is that the fact that something is implemented in Rust is not really a factor (either way) when I'm deciding whether or not to use a particular piece of software.

[timschmidt]

> I do think that it's stretched a bit far

How so?

> Rust is not really a factor (either way) when I'm deciding whether or not to use a particular piece of software.

For a five function calculator or alarm clock app, sure. Browsers have an immense attack surface, handle incredible amounts of untrusted data in hundreds of different formats, and are actively exploited regularly.

Cloudflare reports almost 7% of internet traffic is malicious: https://www.zdnet.com/article/cloudflare-reports-almost-7-pe...

Software which is expected to deal with such hostilities and complexities needs to be written in memory safe languages in 2024.