← Back to context

Comment by octoberfranklin

5 years ago

> https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=rust

Almost all of those are due to code in unsafe blocks. In other words, not safe rust.

A few are cryptographic errors. No argument there, Rust won't save you from that.

FWIW Rust does badly need a standardized unsafe-block auditing mechanism. Like "show me all the unsafe blocks in my code or any of the libraries it uses, except the standard library". If that list is too long to read, that's a bug in your project.

6 comments

octoberfranklin

Reply
sitkack  5 years ago

Related to what you are looking for is https://github.com/rust-secure-code/cargo-geiger which analyzes the dependency tree for unsafe but afaik it doesn't actually show each individual block.

The readme is quite good.

  • octoberfranklin  5 years ago

    Wow, yeah, that's exactly the technological aspect of what I had in mind.

    I guess all that's left is the socialogical aspect: packages' "geiger" status ought to be treated as being as important as their dependencies. In other words, lib.rs/docs.rs/crates.io ought to display these data in all the sorts of places where they list the dependencies of a package.

    It would also be great if this tool were made a standard part of cargo. I think it's important enough to deserve that status.

    • sitkack  5 years ago

      I think this would be a docs.rs or lib.rs feature, I used to think crates.io was that place but it is not.

      I could see there being all kinds of scans of dependencies, like enforcing test coverage, builds and tests passing on certain platforms (risc-v, wasi, etc).

      2 replies →