site banner

Friday Fun Thread for January 31, 2025

Be advised: this thread is not for serious in-depth discussion of weighty topics (we have a link for that), this thread is not for anything Culture War related. This thread is for Fun. You got jokes? Share 'em. You got silly questions? Ask 'em.

2
Jump in the discussion.

No email address required.

I can tell everyone read to the same point, got triggered, and didn't continue reading. So I'll repeat myself.

The problem is that suddenly, thanks to the internet, literally every single line of code needs to become a hardened attack surface. "Exploits" didn't matter in a pre-internet age, and I also question how much Rust will really address them. I doubt at the end of the day a Windows written increasingly in Rust will prove more secure than a Windows written in C. I think Rust is necessitated more by the falling skill level of corporate programmers than anything else, and I also doubt it will remediate that problem. If anything treating Rust as a panacea for a lack of skill will only make the problems worse. Less buffer overflow exploits perhaps, still plenty of attack surface for malicious actors to abuse.

I did continue reading (that's why I mentioned your security strategy), my point is that your argument doesn't make sense. You admit that even skilled programmers get it right only "most of the time". That's not enough in the internet age. Falling skill levels of corporate programmers are not the trigger.

Let me put it like this.

You have a group that is just plain retarded. Literally can't do a single thing correctly. They will literally find every failure mode possible, and there will always be failure modes possible, in record time of whatever "idiot proof" product you put before them. But perhaps, they always hit one failure mode first.

You wouldn't fix that first failure mode, declare victory, and act like a new era of idiot proofing is upon us. There are literally an infinite number of other failure modes out there. Including several they will hit in rapid succession now that you've rendered the first physically impossible.

That's what Rust looks like to me. Good job. You made memory incrementally safer from a specific type of exploit. I'm pretty sure exploit technology has come a long way since then. We're all still fucked as long as we keep our systems permanently interconnected.

This makes more sense as far as your earlier "half measure" comment goes. But I still don't think this is a good way of looking at it. Nobody serious is saying "this fixes all things forever", they are saying "this fixes some of the problems". Which is fine - incremental progress is still progress. I think it's better to appreciate that a tool fixes one problem than it is to say "well it doesn't fix all problems so what's the point?".

Given that interconnection isn't going anywhere, I don't see any good reason not to eliminate failure modes where possible. Nobody is claiming that rust fixes everything.