Hacker News new | ask | show | jobs
by IshKebab 44 days ago
> The lesson for other projects is very different if the reason these are all C++ bugs is just "We didn't ask Mythos for the bugs in Rust" versus if the difference is that asking Mythos for similar bugs in the Rust is futile because it won't find any.

The answer is both of those. They didn't ask for bugs in the Rust code because it wouldn't have found any. They've explicitly set it up to only look for memory safety bugs. It's not going to find any in a memory safe language.
2 comments
uecker 44 days ago
As long as the memory-safe subset of Rust is used exclusively.
link
IshKebab 44 days ago
Not exclusively, just the vast majority of the time. Which it is.

Read this: https://blog.google/security/rust-in-android-move-fast-fix-t...

Exactly the same as using the memory-safe subset of Python or Java.

link
uecker 43 days ago
There exist memory safety bugs in Rust projects, so you will find them. Or maybe not with AI, as there is not enough training data?

The 70% number google claims is either BS or google-specific as other projects reported far lower numbers.

link
IshKebab 43 days ago
> There exist memory safety bugs in Rust projects, so you will find them. Or maybe not with AI, as there is not enough training data?

No, there are simply too few memory safety bugs in Rust projects for AI to find any. It found 271 bugs in Firefox so you're talking around 0.3 bugs found in the same amount of Rust.

> The 70% number google claims is either BS or google-specific as other projects reported far lower numbers.

The post I linked didn't mention 70% so I guess you didn't read it. And if you're talking about the "70% of C/C++ security bugs are due to memory safety" stat, then no it isn't bullshit. The same (or very similar) number has been found by numerous companies and projects. Not that that stat is relevant here.

link
uecker 43 days ago
It is impossible to interpret this number (271) without looking into details. People certainly found plenty of memory safety and others bugs in Rust projects in the past, so I do not understand you claim that there too few to find any.

Curl reported 40% and more recently it dropped to about 20% of issues caused by their use of C. And this even with the requirement to stick to old C89. OpenBSD reported 30%. I assume the 70% either have to do with C++ or - more likely - there is a huge selection bias.

link
tialaramex 43 days ago
> I assume the 70% either have to do with C++ or - more likely - there is a huge selection bias.

Daniel admits that he "might" just be counting differently.

I expect some of it is C++ because there sure is plenty of additional complexity to fit in the same size brain and yet you retain the same absolute requirement to juggle everything at all times or the software blows up but I'd be very surprised if it accounted for this huge disparity.

link
tialaramex 44 days ago
> It's not going to find any in a memory safe language.

I mean, it's not supposed to find any in the unsafe language either, but that's why it was used.

Firefox not only uses unstable Rust features (via the exemption mechanism the same way Linux does it, trained professionals, closed course, do not attempt at home) it also presumably has some volume of its own explicitly unsafe Rust and so there's no reason this could not be checked, and what makes the difference here is whether it was or was not.

link
IshKebab 44 days ago
> I mean, it's not supposed to find any in the unsafe language either, but that's why it was used.

No it is supposed to find them in C++, because we all know humans are infallible and it's super easy to write memory errors in C++.

The whole point of Rust is that the borrow checker is infallible (pretty much anyway).

> it also presumably has some volume of its own explicitly unsafe Rust

"Some volume" is so tiny as to be irrelevant. There's no point going to this effort if Rust memory safety vulnerabilities are 1000 times less frequent than in C++.

That number is not made up. See https://blog.google/security/rust-in-android-move-fast-fix-t...

link
tialaramex 44 days ago
I assume you intended either "humans are fallible" or "humans aren't infallible" ?

I'd like to understand if Rust was skipped because they assumed it would be fine, skipped purely as happenstance, or in fact tested and found to not be problem. I don't like assuming things when I could measure instead.

link
IshKebab 43 days ago
> I assume you intended either "humans are fallible" or "humans aren't infallible" ?

Ha yes.

link