← Back to context

Comment by nayroclade

7 days ago

> I don't know how long this pace will last. I suspect that bugs are reported faster than they are written, so we could in fact be purging a long backlog

Hopefully these same tools will also help catch security bugs at the point they're written. Maybe one day we'll reach a point where the discovery of new, live vulnerabilities is extremely rare?

16 comments

nayroclade

Reply
Sharlin  7 days ago

Around 70% of security vulnerabilities are about memory safety and only exist because software is written in C and C++. Because most vulnerabilities are in newly written code, Google has found that simply starting writing new code in Rust (rather than trying to rewrite existing codebases) quickly brings the number of found vulnerabilities down drastically.

  • bastawhiz  7 days ago

    You can't just write Rust in a part of the codebase that's all C/C++. Tools for checking the newly written C/C++ code for issues will still be valuable for a very long time.

    • zozbot234  7 days ago

      You actually can? A Rust-written function that exports a C ABI and calls C ABI functions interops just fine with C. Of course that's all unsafe (unless you're doing pure value-based programming and not calling any foreign code), so you don't get much of a safety gain at the single-function level.

      2 replies →

  • miki123211  7 days ago

    I find this interesting.

    Curl's Daniel Stenberg claimed during his NDC talk that vulnerabilities in this project are 8 years old on average.

    I wonder where the disconnect comes from.

    • tptacek  7 days ago

      It comes from all his reporters being teenagers in developing countries with older models, and people using SOTA models who know how to qualify a potential vulnerability having much bigger fish to fry than curl. curl is a meaningful target, but it's in nobody's top tier.

  • noosphr  7 days ago

    And to a good approximation all real world Rust uses unsafe everywhere.

    So we now have a new code base in an undefined language which still has memory bugs.

    This is progress.