Post B5pZFPKQWVIHlF1wJs by stiiin@infosec.space
(DIR) More posts by stiiin@infosec.space
(DIR) Post #B5pZFOIcLkFiZLAyrQ by encthenet@flyovercountry.social
0 likes, 0 repeats
Just looked through the security assessment on the rust rewrite of core utils, and this is why just rewriting everything in the last language is such a dangerous things. They literally threw out 20+ years of security fixes because they thought it was cool and would increase security.At least a security assessment was done, but some of those failures are pretty bad, and very likely to have had serious security implications if they were deployed into any real world system. Setting mode bits incorrectly, TOCTOU, arbitrary file overwrites are just terrible.Would I have likely introduced some of the bugs if I had done the work? Yes. Would I have done the work? No, I'm not that crazy.I do wonder if they did white box or black box when they copied functionality. I'm suspecting black box because of some of the errors.https://github.com/Zellic/publications/blob/master/uutils%20coreutils%20-%20Zellic%20Audit%20Report.pdf
(DIR) Post #B5pZFOkcfcebyCHLVo by stiiin@infosec.space
0 likes, 0 repeats
@encthenet I recently bought two books by Shigeo ShingÅ, from the mid-1980s. One of them (Zero Quality Control: Source Inspection and the Poka-Yoke System) consists for a large part of single-page forms explaining factory worker's mistakes causing faulty products, countermeasures taken, the costs involved, and the estimated savings of not shipping faulty products.As I browsed through them, I had a similar realisation: this history isn't just a record of management decisions, or to show off how valuable the quality control is, or how to appreach quality control work, but it is capital. It is know-how that comes with the design of the product. Some of those fixes were as small as "make a little raised lip of metal so that you can't install the switch the wrong way around". But if you'd disassemble the end product and see that bit of metal jut out, you might just think, "huh, that looks useless."A redesign that doesn't also scrutinise all the mistakes that were made is doomed to repeat them.
(DIR) Post #B5pZFPKQWVIHlF1wJs by stiiin@infosec.space
0 likes, 0 repeats
@encthenet That said, I have yet to see a software project that has such a clear collection of "historical bugs and how we fixed and prevented them" body of knowledge. I doubt coreutils has one.
(DIR) Post #B5pZFPeHKhAokoJnGK by encthenet@flyovercountry.social
0 likes, 0 repeats
@stiiinYeah, probably not a record of how they prevented them in the future, but the point is that it's had a history compared to the new coreutils.The new product might be better or not. As with all new things, you get a new set of problems. Do you want an unknown set or a set that is decently known?
(DIR) Post #B5pZFPouh9gFHnIHq4 by encthenet@flyovercountry.social
1 likes, 0 repeats
@stiiinAnd unsurprisingly, all the bugs are logic bugs, but the other question is, when was the last time the cp or rm or mv had a segfault or memory safety bug?Those utilities aren't a major source of memory safety bugs. They're a source of logic bugs, and converting to rust doesn't magically fix logic bugs.Rewriting libjpeg or other file parsing libraries would be a more useful endeavor, less logic to get wrong, more likely to have memory safety issues in C.
(DIR) Post #B5pZFQ8PWfHCGGPrEG by feld@friedcheese.us
1 likes, 0 repeats
@encthenet @stiiin "but you don't understand, we need to rewrite /bin/rm to burn 7 barrels of oil while compiling so we are certain that the one call to free() is automated"