Post B5y6AXM86L4Gxgn8HA by lispi314@udongein.xyz
(DIR) More posts by lispi314@udongein.xyz
(DIR) Post #B5xjfTWS6e6V6UP3zM by lcamtuf@infosec.exchange
3 likes, 5 repeats
The coreutils Rust rewrite story is pretty funny.Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:https://seclists.org/oss-sec/2026/q2/332PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.
(DIR) Post #B5xjfToB2kHXzShDcG by xerz@soc.masfloss.net
0 likes, 0 repeats
@lcamtuf ........ouchI'm shocked they didn't account for any of that
(DIR) Post #B5xjfU8NpcRf089M6y by hypha@cafe.mycelium.locahlo.st
0 likes, 0 repeats
@xerz @lcamtuf it’s easy to fall for domain specific knowledge traps when you’re learningwhich is why it’s often advised against rewriting software from scratch, especially if you were not in the first team of developers
(DIR) Post #B5xjfUMD0DVJh0cOf2 by star@amazonawaws.com
0 likes, 0 repeats
@hypha @xerz @lcamtuf tbf i think the framing that "they shouldn't have" is wrong and bad. *canonical* should not have switched, because that is such a bad idea
(DIR) Post #B5xmNVepjF08NMRrQu by lanodan@queer.hacktivis.me
0 likes, 0 repeats
@lcamtuf Also quite few are noticeably fails in implementing POSIX, which makes me wonder if they're only caring about coreutils testsuite and --help/help2man output.Like CVE-2026-35367 (nohup(1) permissions) as Colin Funk noted, but also CVE-2026-35369 (kill -1), CVE-2026-35370 & CVE-2026-35371 (real vs. effective in id(1)), and CVE-2026-35379 (wrong character classes in tr(1))
(DIR) Post #B5xsYoeW2uUiCK4fqa by raymaccarthy@mastodon.ie
0 likes, 0 repeats
@lcamtuf I learned C++ after Modula-2 and before C.I learned programming earlier.Learning a programming language isn't learning programming (extracting requirements, specification, design, coding, test etc).I looked at Rust. C++ certainly has got too complicated since 1987, but I wonder does Rust *only* help with memory safety?Main memory safety in general relates to using pointers that are invalid, accessing arrays out of bounds and past the end of strings.Partly bad libraries & design.
(DIR) Post #B5xsYpIvceowDeywq0 by zardoz03@mastodon.online
0 likes, 0 repeats
@raymaccarthywell allegedly its types are meant to aid in type driven design and better domain modelling; but i dont know if this is actually seen in practice in better code structure. same could be said of cxx + its classes @lcamtuf
(DIR) Post #B5xsYq8gWEDkoBCHVg by fiore@brain.worm.pink
0 likes, 0 repeats
@zardoz03 @raymaccarthy @lcamtuf id argue that rust as a language is pretty much strictly better than c++ in every single aspect . please not that i said as a language . im keeping out ecosystem , build systems , portability , bootstrappability , etc . those things can be argued about and rust has some, to be very nice to it , lets call them annoyances. but as a language , meaning its syntax and semantics , its just. theres no point in even arguing .
(DIR) Post #B5xsbCJj23nqAhU9zM by controlc@mstdn.ca
1 likes, 0 repeats
@lcamtuf "The lesson of history is that no one learns."
(DIR) Post #B5xscp4IRSTQe62lSi by migratory@jorts.horse
1 likes, 0 repeats
@lcamtuf this is so funny and predictable because it's applying Rust in precisely the domain where it doesn't help: opaque, imperative side-effects in the global mutable state of the UNIX world of the filesystem and process tree
(DIR) Post #B5xsh8tEggrpHOviQi by fiore@brain.worm.pink
0 likes, 0 repeats
@zardoz03 @lcamtuf @raymaccarthy its weird because this is not something that should ever be said . things are nevwr “better” , per se . and yet
(DIR) Post #B5xspx7zmt65PI2DEu by ireneista@irenes.space
0 likes, 0 repeats
@lcamtuf yeah it's frustrating because in some sense we all had the opportunity to learn this lesson, a long time agowe remember when we were kids, after Netscape went bankrupt trying to re-write their software from scratch, there were some good essays analyzing what went wrong and advocating for refactoring instead so as not to lose the knowledge that's in the codeand then there's the ATC systemlike... there's so many past instances to learn from
(DIR) Post #B5xspxNaqtZeBfKfYG by ireneista@irenes.space
0 likes, 0 repeats
@lcamtuf and then there's... well, there's a persistent feeling that starting over without regard for the past will make things better, rather than just repeating the same fundamental mistake that happened the first timewe've felt it too. it's a powerful pull.we wrote a bit about that feeling, a while back https://irenes.space/leaves/2024-09-29-technology-community-idealism
(DIR) Post #B5xspxcTxXU2vqIYl6 by Doomed_Daniel@mastodon.gamedev.place
0 likes, 0 repeats
@ireneista @lcamtuf I guess that could work if you really investigate all the fundamental mistakes, as well as the regular bugs/pitfalls, from the first time and try your best to avoid them.Assuming that "it was written in a less safe language" was the only or even most important issue is.. not that useful
(DIR) Post #B5xspxmPMdQJQcwUEK by ireneista@irenes.space
0 likes, 0 repeats
@Doomed_Daniel @lcamtuf yeah, exactly
(DIR) Post #B5xspxuCtdf5ooaiO0 by ireneista@irenes.space
0 likes, 0 repeats
@Doomed_Daniel @lcamtuf we firmly believe, for ourselves, that code is communicationand one very big thing it's communicating is: hey, future maintainer, this detail is important
(DIR) Post #B5xspy4qG6AWLnZCxk by Doomed_Daniel@mastodon.gamedev.place
0 likes, 0 repeats
@ireneista @lcamtuf Additional fun thought: I can imagine they avoided looking at the GNU coreutils C implementation because they are using MIT license instead of GPL.
(DIR) Post #B5xspyDhj9G2nHiHmC by ireneista@irenes.space
0 likes, 0 repeats
@Doomed_Daniel @lcamtuf ouch. welp.
(DIR) Post #B5xspySwoTS1YYqSXI by puppygirlhornypost2@transfem.social
0 likes, 0 repeats
@ireneista@adhd.irenes.space @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place Well there's always the ability for clean room implementation, no?
(DIR) Post #B5xspyeI8IWc7k9WDY by Doomed_Daniel@mastodon.gamedev.place
0 likes, 0 repeats
@puppygirlhornypost2 @lcamtuf @ireneista sure, but needs more people, and some of them won't get to do the fun part (writing new code)they could've looked at musl though, I assume it does not have the same bugs (but am too lazy to check)
(DIR) Post #B5xspynrYiBIbQdA8W by puppygirlhornypost2@transfem.social
0 likes, 0 repeats
@Doomed_Daniel@mastodon.gamedev.place @lcamtuf@infosec.exchange @ireneista@adhd.irenes.space I think you mistook musl for BusyBox. I did the same thing in my head. (musl is an MIT-licensed C standard library implementation) It appears BusyBox (alternative to gnu coreutils) is also licensed under GPLv2, unfortunately.
(DIR) Post #B5xspyy8wUP97JRNA0 by fiore@brain.worm.pink
0 likes, 0 repeats
@puppygirlhornypost2 @lcamtuf @Doomed_Daniel @ireneista busybox is not an alternative to gnu coreutils , it doesnt care to be coreutils compatible .. uutils does (for some reason??)
(DIR) Post #B5xsu9pEWMAdwgGPjM by BalooUriza@social.tulsa.ok.us
1 likes, 0 repeats
@lcamtuf I legitimately wonder what it is about Rust that inspires people to start questionable porting projects in the first place. Like, who asked for coreutils in Rust?
(DIR) Post #B5xtQyzBqIIRsrZbHM by puppygirlhornypost2@transfem.social
1 likes, 0 repeats
@fiore@brain.worm.pink @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@adhd.irenes.space I mean there's "alternative" and then there's "drop in replacement". I guess that was a linguistic issue on my part. I did not mean to imply busybox is supposed to be a remake of gnu coreutils. Some commands/programs/whatever (the windows sysadmin in me wants to say commandlets lol) of coreutils such as shuf are not available on busybox. I do see it advertised as a light weight alternative to gnu coreutils in server applications. Specifically when you don't need GNU coreutils-specific features
(DIR) Post #B5xtSVmjNjmHtjTUY4 by puppygirlhornypost2@transfem.social
1 likes, 0 repeats
@fiore@brain.worm.pink @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@adhd.irenes.space iirc busybox is often used in initramfs and other light environments like containers. I mean, on my Gentoo desktop, I have the busybox module installed for dracut, so it's packed into my initramfs... but also that's not something that's default with the distribution.
(DIR) Post #B5xtVoFVBo0O22VLiS by fiore@brain.worm.pink
0 likes, 0 repeats
@puppygirlhornypost2 @lcamtuf @Doomed_Daniel @ireneista yep . if you wanna run stuff in containers , theres little to no point to use something other than alpine as a container base .
(DIR) Post #B5xtrlPqP5xbcEoKI4 by ireneista@irenes.space
0 likes, 0 repeats
@puppygirlhornypost2 @lcamtuf @Doomed_Daniel ... wait, is BusyBox an alternative? we thought it was the same coreutils, just bundled in a single executable for deployment reasons?
(DIR) Post #B5xtrlk3By7icuGSmm by puppygirlhornypost2@transfem.social
0 likes, 0 repeats
@ireneista@adhd.irenes.space @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place I thought it was entirely independent from gnu coreutils.
(DIR) Post #B5xtrlvOVnCJC5ZWT2 by fiore@brain.worm.pink
0 likes, 0 repeats
@puppygirlhornypost2 @lcamtuf @Doomed_Daniel @ireneista it is . it ships many commands that coreutils does , but its a completely indipendent implementation .
(DIR) Post #B5xtsGSOzdQTt9FJ56 by ChuckMcManis@chaos.social
0 likes, 0 repeats
@lcamtuf mumble, mumble, Chesterson's Fence, mumble, mumble
(DIR) Post #B5xtsGrDVNH986r7lA by darkuncle@infosec.exchange
0 likes, 0 repeats
@ChuckMcManis @lcamtuf came to say this, you beat me to it, well done
(DIR) Post #B5xtsH18uTDPctV3EO by ChuckMcManis@chaos.social
0 likes, 0 repeats
@darkuncle @lcamtuf During my tenure at Google I was astonished at how many engineers would clearly admit they didn't understand why something was the way it was, so they rewrote it. This *repeatedly* bit them in the ass.
(DIR) Post #B5xtsHHRvqG8RT84eG by darkuncle@infosec.exchange
0 likes, 0 repeats
@ChuckMcManis @lcamtuf sometimes that's the only way to learn, but it's also often the most effective way to learn
(DIR) Post #B5xtsHVz3nsxAXvgIq by sten@chaos.social
1 likes, 0 repeats
@darkuncle @ChuckMcManis @lcamtuf Sure, but perhaps don't do your learning in production? :)
(DIR) Post #B5xtsHiOJfoHn1jads by wolf480pl@mstdn.io
0 likes, 0 repeats
@sten @darkuncle @ChuckMcManis @lcamtuf you expect rare race conditions to occur anywhere but production? :P
(DIR) Post #B5y6AX6t10sICPexW4 by xerz@soc.masfloss.net
0 likes, 0 repeats
@star @hypha @lcamtuf yeah, the audits should have come first, not the other way aroundall they did was give them free patches, so uh... yet another Rust advantage? :baa:
(DIR) Post #B5y6AXM86L4Gxgn8HA by lispi314@udongein.xyz
0 likes, 0 repeats
@xerz @star @hypha @lcamtuf Switching to dependencies with a single non-replaceable toolchain is also irresponsible.Core utilities should not rely on something that can believably be slopped into oblivion with no viable replacement (C compilers are a dime a dozen and comparatively much easier to implement, with many functional replacements readily available).Proper specification of all the core toolchains should be a bare minimum.
(DIR) Post #B5y6AXbjALXpk45aaW by xerz@soc.masfloss.net
0 likes, 0 repeats
@lispi314 @hypha @star @lcamtuf in fairness GNU has a viable alternative, gccrs is aiming for Rust 1.49 and is getting quite close https://rust-gcc.github.io/2026/04/13/2026-03-monthly-report.html.....not sure what compiler version uutils requires tho
(DIR) Post #B5y6AXqGIJAeT8tCF6 by lispi314@udongein.xyz
0 likes, 0 repeats
@xerz @hypha @star @lcamtuf Last I had heard from gccrust is that it couldn't even be used for bootstrap compiling yet, without enforcing any of the semantics a Rust compiler is expected to.It's unclear whether it also now does that as of this progress report or not. If it does then that would be progress indeed.
(DIR) Post #B5y6AY2JZUoP4WWp1s by star@amazonawaws.com
0 likes, 0 repeats
@lispi314 @xerz @hypha @lcamtuf you don't need borrow checking in well-formed programs. You need borrow checking to ensure a program is safe. the rust compiler is currently the definition of what is well-formed so you don't really have an advantage if you compile the 1.49 sources with or without borrow checking
(DIR) Post #B5yF4VIVjyHqQaISq8 by IngaLovinde@embracing.space
0 likes, 0 repeats
@pinskia @ireneista @lcamtuf > It is also why Microsoft Edge went from something written from scratch to be a fork of chromiumWasn't that because most of Edge audience heavily used Google products (including Google maps and YouTube and Google meet), and Google actively sabotaged the performance of these products in Edge specifically, in order to push users away from it and towards Chrome?
(DIR) Post #B5yJUlFFTF9lEXXxVA by darkuncle@infosec.exchange
0 likes, 0 repeats
@wolf480pl @sten @ChuckMcManis @lcamtuf most serious race condition in production is the race to push to prod before you bounce on a Friday afternoon
(DIR) Post #B5ydpNnLqmYFfYbnhw by uecker@mastodon.social
1 likes, 0 repeats
@hunger @lcamtuf The operation was successful, but the patient is dead. The extra problem here was that the operation wasn't necessary as there were not much much memory issues in the first place.
(DIR) Post #B5z2vpBLR8lFCT031c by synlogic4242@vivaldi.net
0 likes, 0 repeats
@lcamtuf Rustaceans are the problem, not Rust itself. theyre like a lobbing group trying explicitly to boost their future employment demand much more than prioritized on doing the right thing as engineers or for the community. much like the AI VC are "talking up their book" even if its poison for the rest of us
(DIR) Post #B5z2vrfCD7pMtcyupc by rmq@toot.io
1 likes, 0 repeats
@synlogic4242 Uutils started as someone’s personal project to learn rust, and “write a system utility” is frequently used as a basic exercise for learning. Uutils is doing exactly what it set out to do.It’s not the fault of uutils that Canonical is dumb.@lcamtuf
(DIR) Post #B5z34aeWpFkKkDpWOu by synlogic4242@vivaldi.net
0 likes, 0 repeats
@rmq @lcamtuf I view it as both their fault. I'm pissed that after having to deal with Copy.Fail I now have to wipe other people's butts again for them. and I worry this will happen with more frequency as more vibe-coded software spreads around
(DIR) Post #B5z34aps94ovJP8a5A by star@amazonawaws.com
0 likes, 0 repeats
@synlogic4242 @rmq @lcamtuf Do you have any concrete pointers or sources for uutils actually contributing to the problem, since it seems pretty well established that this has been solely Canonicals choice, or are you just dragging in rustaceans because you feel like it?
(DIR) Post #B5zPAlLKBrmad3CD7g by kgMadee2@mathstodon.xyz
0 likes, 0 repeats
@IngaLovinde @pinskia @ireneista @lcamtuf I suppose, same as Firefox still
(DIR) Post #B5zR40xFwoEkvfqdw8 by IngaLovinde@embracing.space
0 likes, 0 repeats
@kgMadee2 @pinskia @ireneista @lcamtuf apparently at that point Google did not consider FF a threat but did consider EdgeHTML a threat.I remember reading some technical write-ups on how that sabotage worked.
(DIR) Post #B61tDLevWaJOmWQwl6 by hunger@floss.social
0 likes, 0 repeats
@uecker @lcamtuf Who am I to judge whether or not other people's projects make sense or not? I do find it a bit daring to adopt it this early in a distribution, but who am I to tell canonical what they should or should not do? And who knows whether or not there are memory issues in gnu coreutils? These buggers are surprisingly good at hiding.With a bit of luck rust will get a couple of warnings about TOCTOU issues in their linter now or a better crate for file handling.
(DIR) Post #B61tDM6ZrmQiAHN1rE by uecker@mastodon.social
0 likes, 0 repeats
@hunger @lcamtuf Why should we not judge technical decisions based on technical arguments?
(DIR) Post #B61tDMQ4hI1f8kUbFQ by hunger@floss.social
0 likes, 0 repeats
@uecker @lcamtuf oh, I judge whether projects are fit for my use cases all the time. That is very different from judging projects.It annoys me when I read "project X or Y is a waste of time". It obviously is not to the people that run it, its their time and they are free to do with it whatever they want.
(DIR) Post #B61tDMdtrt5JpcxdnU by uecker@mastodon.social
0 likes, 0 repeats
@hunger @lcamtuf I am perfectly fine with people using Rust for whatever reason they may have. I push back against the idea that projects need to be written in Rust because of memory safety.
(DIR) Post #B61tDMqf6RIETCvpgm by hunger@floss.social
0 likes, 0 repeats
@uecker @lcamtuf *shrug* If someone wants to rewrite something, she will do it eventually. I have seen worse excuses to rewrite stuff than to have a memory safe version of it.Yes, you can write a memory safe programs in both C and C++, but you can't know whether you failed to do so -- till someone exploits your bug a couple years later. You will never know whether you succeeded. I find that very frustrating working with either of those languages.
(DIR) Post #B61tDN1IStnf0BuKGW by uecker@mastodon.social
0 likes, 0 repeats
@hunger @lcamtuf People can rewrite whatever they want, but I do not think one should encourage them. As this example shows, the exclusive focus on memory safety may be very misleading as their are many issues to worry about. There are also other ways to reduce the risk of memory safety issues in C/C++ and compared to them the advantages of Rust may be exaggerated. Rust also introduces new risk such as an ecosystem susceptible to supply-chain risks.
(DIR) Post #B61tDNNH9BNg6MBsWW by hunger@floss.social
0 likes, 0 repeats
@uecker @lcamtuf You think there were other people in the room egging on the rust coreutils person?Thousands of rewrites of are started each day... most of them end up on some SSD somewhere and never even make to a forge. For any rewrite to get popular, it needs to find a community seeing a need and willing to chip in. Why would you know better than those people?I do encourage rewrites: It is how people learn how things work. We need morr people that understand things, not less.
(DIR) Post #B61tDNfM3xqJ0QeJhg by uecker@mastodon.social
0 likes, 0 repeats
@hunger I am not complaining about people writing or rewriting things for learning. But canonical's motivation to invest in this project was entirely different and seems to be based on the false believe that this must be good replacement for GNU coreutils because it was written in rust. But also in general, I would encourage people to help with maintaining projects instead, because this is where the critical need is and one can also learn a lot.
(DIR) Post #B61tDNsTHCKnf6mn9E by hunger@floss.social
0 likes, 0 repeats
@uecker Canonical is a bit early, but they want as much time to test before the next LTS.My experience replacing C and C++ tools with rust equivalents has been very positive so far (after an initial stabilization phase of course). Nothing crashes anymore. I will never go back to C-based shells.The problem is that there is little overlap between people interested in rewriting a tool in Rust and people wanting to maintain C or C++ code. You won't convince the former to help with the latter.
(DIR) Post #B61tDO2keyYeAzb0Ai by uecker@mastodon.social
0 likes, 0 repeats
@hunger I never had any of my C tools I use on a daily bash crash in decades (vim, kernel, terminals, bash, etc.), so I really wonder what C programs you use? Also C++ tools are in my experience very stable. I do not have much experience using tools written in Rust, but cloudflare's Rust code famously brought down the whole internet... Rust packages also come with limited security support in Debian: https://www.debian.org/releases/stable/release-notes/issues.en.html#go-and-rust-based-packagesSo rust - so far -- made my security worse not better.
(DIR) Post #B61tDOERxTuolH4LPE by hunger@floss.social
0 likes, 0 repeats
@uecker Pretty normal stuff... shells and console tools:-) Yeap, many C++ tools are pretty OK. Still use lots of those, mostly on the GUI side.Yeap. Cloudflare killed the internet using a rust program. So did log4j and heartbleed before it. At least the cloudflare bug did not leak information to attackes, it was "just" a denial of service.Yes, Debian is pretty braindead wrt. rust.
(DIR) Post #B61tDOOjLG8fH9sYQi by uecker@mastodon.social
1 likes, 0 repeats
@hunger Well, heartbleed was even in 2014 then a stupid errorhttps://web.archive.org/web/20140411014301/http://article.gmane.org/gmane.os.openbsd.misc/211963Nobody guarantees that some "unsafe" added for performance does not bite you in the same way. Log4j was java, which came at some time I still remember with very similar promises about security as Rust.