[pcwalton]

> It appears that most of these attacks relied on exploiting the unfortunate design of C, which makes manual memory management the default and safe, managed memory the special case. It should be the reverse. Speed will always matter, but you don't have to use risky, manual memory mgt everywhere to get speed; you just need it in the few spots where it makes a difference.

That's true, but I would claim something even stronger. Getting safety doesn't mean giving up manual memory management, as Rust shows (disclaimer: I work on Rust). You just have to need to have a language or system that enforces that you use safe manually-managed idioms. The idea that safety requires giving up performance (e.g. opting into a garbage collector, or even a runtime) is not true in most cases. In a properly designed system, safety doesn't even require opting into a runtime.

[SiVal]

Would Firefox be better (more secure and with no performance handicap) if written in Rust? I realize that there is an enormous amount of existing code that shouldn't be thrown away, but if Mozilla wanted to create a browser from scratch today (or in a couple of years, when Rust has been debugged and polished), would they write it in Rust?

[letney]

This is exactly what Servo[1] is.

[1] http://www.fastcolabs.com/3027664/under-the-hood-of-mozillas...

[hershel]

Pcwalton, do you guys at mozilla think servo could be foolproof against sandbox escapes, or that this is a bit unrealistic ?

[pcwalton]

There's no such thing as "foolproof against sandbox escape" without proving a sandbox, as well as all it depends on, correct. But I believe that memory safety is a security advance.