US Government declares the safest programming language

White House issues report about the future of cybersecurity and programming. Specifically: the Rust Programming Language.
www.whitehouse.gov/wp-content...
🏫 COURSES 🏫 Learn to code in C at lowlevel.academy
📰 NEWSLETTER 📰 Sign up for our newsletter at mailchi.mp/lowlevel/the-low-down
🙌 SUPPORT THE CHANNEL 🙌 Become a Low Level Associate and support the channel at / lowlevellearning
🛒 GREAT BOOKS FOR THE LOWEST LEVEL🛒
C Programming Language, 2nd Edition: amzn.to/3OKh3q2
C++ Crash Course: A Fast-Paced Introduction: amzn.to/3qdZILK
The Rust Programming Language, 2nd Edition: amzn.to/3MHaS36
🔥🔥🔥 SOCIALS 🔥🔥🔥
Low Level Merch!: www.linktr.ee/lowlevellearning
Follow me on Twitter: / lowleveltweets
Follow me on Twitch: / lowlevellearning
Join me on Discord!: / discord

[@LowLevelLearning]

go learn C before its illegal 😞 lowlevel.academy

[@matthewbass8152]

SO @doce3609 lol

[@OneMilian]

If C gets Illegal ill invent something different than C, maybe with better tools for articulating Objects and Problems very fast.. I dont have a Name yet but because its based on C im thinking of something with a plus.

[@brandonphilander661]

Just learn Odin.

[@jongeduard]

We still have ASM superpowers. And if ASM gets disallowed too, we'll just hide ourselves inside a Rust unsafe block and do very naughty things, like using the ASM macro. :P

[@sashimisub8536]

Lmao

[@jesseparrish1993]

Trump is going to come out for C. "Lots of hard working C miners here today. C is a great language. I've written a lot of C. Nobody writes more memory safe code than I do."

[@U20E0]

that'd be fun

[@y00t00b3r]

a lot of us 400-pound hackers are pretty good C programmers!

[@Kane0123]

Lol

[@jesseparrish1993]

@@Kane0123 "C jobs built America. C powers everything. We love C here in West Virginia, folks. Not Biden. Rusty Joe they call him. They do call him that don't they? Sleepy and rusty."

[@pluto8404]

"I here to use rust you have to identify as lgbtq+zxtruq and give up your guns, they say. Thats not going to happen in C, I wont allow it. I liked it before it was cool, and now they dressed it all up in drag and call it c++, you here about this folks, its a shame, so sad"

[@tempo5366]

Apparently, Joe forgot to free his memory.

[@jklax]

Lmao

[@echoptic775]

Rust made a memory leak inside his brain

[@lionelt.9124]

If he doesn't will the rest follow?

[@HanWae363]

Wym, all he does is free memory. Bro tries to free Stack allocated memory sometimes. He's trying to update his hardware to rust

[@Nofiamich]

Hahaha 😆

[@steamer2k319]

So the NSA has finally collected enough zero-days that they're now allowing recommendations in favor of Rust?

[@sixbutton9]

no they got a back door.

[@monad_tcp]

@@sixbutton9 Rust still uses the LLVM, so there's still a lot of undefined behavior and unsafe things for years to come.

[@diadetediotedio6918]

@@monad_tcp There is no UB in normal safe Rust code (and if there is it would be fixed eventually).

[@steamer2k319]

@@lawrencemanning 😆

[@Turalcar]

@@diadetediotedio6918 define "normal"

[@kickeddroid]

"Skill issues" but programmers still won't follow basic input validation lmao

[@samuele5931]

What are e we talking about? Critical software that has become infrastructure or critical software that is a product of a company?

[@rahzaelfoe3288]

Basic input validation is so much easier to do in Rust, though. If I want to parse JSON (or any other of dozens of serialization formats) into a Rust struct I just import Serde and derive deserialize on my struct and it writes the parser for me. It then forces me to check to see if the parse succeeded or failed, and if it succeeded I now have a reference to a fully instantiated and syntactically correct instance of my struct without a null pointer in sight. If I want to add semantic analysis, I could then write a simple parser that parses MySerdeStruct into Result. Alternatively, if I wanted to do it all in one go I could instead just implement the Deserialize trait for my struct and bake in the semantic analysis. Boom, if I have an instance of MySemanticallyCorrectStruct anywhere in my program it's now guaranteed to have been instantiated, validated, and point to a valid location in memory.

[@Kane0123]

Users will read the guide, so validation isn’t important.

[@MrSofazocker]

@@Kane0123 I agree. You should educate your users. After all. User Input should always be correct so you can trust it at all times in your code.

[@OlegLecinsky]

@@rahzaelfoe3288 You do realize that Serde is a library, not a language, don't you? And there are libraries to do the JSON parsing and validation in C++, you don't have to write all the code yourself.

[@SpaceEndeavour]

Garbage collectors are generally not used in aerospace because most garbage collectors temporarialy stop code execution for a short period of time and stopping code execution, even for a small amount of time, on a rocket that is accellerating very very fast is not a good idea

[@godspeed2145]

Elaborate

[@tiranito2834]

@ed2145 I'll write it in very simple words, since you seem to not understand what the problem could be... if computer in rocket stop, thing can go boom! people go ouch, thing is no no. Capiche? Like, look, I mean no disrespect, but seriously, I think it is very clear that if your on board computer stops for a while on any aerospace related field, then you are going to have a lot of problems, because the computer is meant to keep up to date at all times. It is a critical system that could completely fall appart if it cannot perform the very precise operations and flight adjustments it has to perform at all times... This applies to satellites, rockets, planes, anything, you name it... or would you feel safe having something fly overhead knowing its onboard computer could suddenly decide to just freeze for a few nanoseconds just for the whole thing to fall on top of you? Yeah, that's what I thought.

[@anon_y_mousse]

@@tiranito2834 I'm starting to think that all the people not understanding why GC would be bad for spacecrafts just don't understand how GC works.

[@tiranito2834]

@@anon_y_mousse Yeah, they must think its some kind of miracle device capable of cleaning up their memory in an instant and that there is no overhead to it. "GC is the secret ingredient in the magic sauce of memory management. It just works."

[@asdion]

@@anon_y_mousse That's the sad reality of the way GC works. Out of sight out of mind.

[@yrtepgold]

The White House is the trusted authority that I always look for guidance from when I am trying to decide what language to use in my next project.

[@kippie80]

😂🎉

[@daniellundqvist2926]

You don't have to listen to them, there are many others that have said this before them.

[@reiniermoreno1653]

You don't have to hear them but they're just repeating what people who has nothing to do (as far as we know) with NSA have been saying from the very beginning: never trust in the programmer

[@catsupchutney]

I'm not a C coder, just an old sysadmin. I think automated garbage collection is prone to periodic pauses when resources are freed up, so an RTOS would be subject to mysterious timing issues.

[@stzi7691]

Well, there are Java VMs developed that are suitable for real time systems. Not very popular, expensive, and mostly used in military/ some automotive. There is one called "Jamaica VM" and one developed by "ptc". But Java is still extremely memory hungry. I would like to have my IoT device being able to run on battery a few years.... and without crashes.

[@Templarfreak]

GCs also require a good amount of speed and memory themselves to manage that space-grade hardware may not have. space-grade processors need to be much simpler and thus probably much slower in order to be less prone to errors when exposed to space. dynamically allocating and deallocating memory in space can also be a big problem when communication timing is an absolute critical essential in space for a variety of reasons and dynamically managing memory can lead to unpredictable timing.

[@Galahad54]

There's ways to enter during garbage collection. I can think of three without looking at the code in question.

[@RonnieRedd]

The Whitehouse should write a similar statement regarding open source being safer than proprietary and closed source

[@theoriginalneckbeard]

In a parallel universe where America isn't the definition of Capitalism/Globalism/Imperialism exactly that happened. Richard Stallman got a medal of honor there.

[@stpedro-ht9ng]

too based for the gov i'm afraid

[@markojojic6223]

Why would they do that? Closed source is superior from certain points of view.

[@RonnieRedd]

@@markojojic6223 Facts are not points of view. Security through obscurity is a farce

[@tirushone6446]

true, the only reason the us gov can confirm rust is memory safe is because the compiler is open sourse

[@marklonergan3898]

"up until recently, security was an afterthought" (That implies that it no longer is) * IoT has entered the conversation *

[@15743_Hertz]

Focusing on security makes it harder to get things working.

[@dxfate]

white house using Rust before GTA 6 is crazy 💀

[@dualfluidreactor]

heyeyey slow down your horses - nobody said anything about using! The white house is talking - and that's the only they ever do

[@pluto8404]

once the nsa endorses rust, is the day ill stop using it.

[@mizu_7422]

@@pluto8404 why

[@virtuosisimo]

I haven't done video games, but do lots of GUI and OOP is a must, type hierarchy just looks natural

[@memes_gbc674]

@@mizu_7422 they planted 5g bugs into my esp32

[@dickheadrecs]

This is ridiculous - everyone knows that the only choice for not only a memory safe but memory efficient stack is pure javascript

[@fotnite_]

So true, that's why we wrote our blazing fast JS engine in JS

[@dickheadrecs]

@@fotnite_ xzibit.gif.js

[@theblinkingbrownie4654]

Yeah, why isn't the linux kernel being rewritten in js?

[@Galahad54]

Nah, PHP is the most secure. After all, what hacker is going to infiltrate PHP code? Hmmm ... by that logic, Intercal has to be ideal for truly secure code.

[@dickheadrecs]

@@Galahad54 of course, it stands for Pure Hack-Proof

[@ferdynandkiepski5026]

The sentiment about not having GC for space use could be due to avoiding GC pauses.

[@eldrago19]

I think also they might not run leading to running out of memory.

[@TheOriginalBlueKirby]

​@@eldrago19Try that again

[@supermortar2862]

Understood, will keep using C

[@malusmundus-9605]

Yeah the government will not tell me what language to use

[@oserodal2702]

Typical C programmer (no shade).

[@climatechangedoesntbargain9140]

@@malusmundus-9605are you being sarcastic? Couldn't tell these days 🤷‍♂

[@Twysthor]

calling the cops

[@undeadpresident]

"C gives the programmer too much freedom. We need more security! I hereby declare C to be a terrorist organization!"

[@DynamicalisBlue]

Modern C++ can definitely be memory safe. Maybe not to the extent of Rust but still very safe. The problem is that the C++ compiler still allows you write legacy unsafe code. It would be nice to see an option across all C++ compilers that prevents clearly unsafe C++ code from compiling.

[@stifflery]

I think that's what Byarne Stroutstroup said too. He was implying something like; in C++ we should be allowed to use memory unsafe features only by manually adding those unsface compiler flags. All the safest features should be enforced by default in the first place. If that does become a reality for future compiler versions, most of the vulnerabilities can be eliminated.

[@seasong7655]

Gotta love politician driven development 😥😥

[@volkwell-wk3eq]

VOP - virtue_signaling oriented programming. It is the future. RUSTRANNY ZISTAS. GO GO GO!

[@undeadpresident]

Watch them try to make a list of all C programmers and leverage their ISP's to cut their internet service and deny them plane flights.

[@Twysthor]

New paradigm Yay

[@homeape.]

the eu supports a ton of FOSS, like... idk, gnome. so yeah. often enough that's actually something i love

[@user-uj4gr9ql4m]

always knew there's something not right with rust

[@doce3609]

C is illegal now

[@guyblack9729]

the c in c stands for crime

[@matthewbass8152]

@@guyblack9729what about c++

[@bruhzzer]

@@guyblack9729 what do the rest of the other letters stand for?

[@NinjaRunningWild]

@@bruhzzerPropaganda.

[@mechano6505]

If only it wasn't one of the most compatible languages out there with extensive tooling and libraries. I don't think it's going anywhere anytime soon.

[@hungrymusicwolf]

The problem they note is real and serious, but until they start punishing intelligence agencies for asking for backdoors I will not take them seriously. Put your money where your mouth is. Don't complain but refuse to pay the price (of not getting to infringe on people's privacy).

[@undeadpresident]

Indeed, I'm more concerned about being secure from government intrusion than the other way around.

[@y00t00b3r]

@@undeadpresident I really don't mind the NSA having all sorts of dirty tricks. Just so long as they don't share them with the FBI! Unfortunately, it's hard to tell if they do or not, besides the fact that the FBI is constantly whining about encryption.

[@user-yw8sr3uj1w]

I agree

[@NullParadigm]

@@undeadpresident Governments are the number 1 producer of malware, governments everywhere are just criminal organizations

[@y00t00b3r]

@@TapetBart ok, mastermind, how is your posting on the internet going to prevent the NSA from stockpiling zero days? They aren't really sensitive to public sentiment. Not that the FBI is, either. Are you saying it's not worse for civil liberties for the agency in charge of law enforcement in the USA to have these sorts of capabilities? Because, of course, it is far worse for the FBI to have access, rather than just the foreign intelligence agencies. (except for the CIA, they can't keep anything a secret) BTW, I believe the phrase you are looking for is "room temperature IQ", not "room level IQ"

[@virtuosisimo]

The last time the USA goverment tried to influence on software development they created a programming language called ADA, then it became popular and took over the world (psic). That happened at the same time that C++ was brooding, before most of us where born

[@anon_y_mousse]

Thanks for reminding me that I'm old.

[@zwanzikahatzel9296]

how did it take over the world, most programmers never even heard of it

[@vvert1506]

history repeats itself rust++

[@Heater-v1.0.0]

That is not how I remember it. The US government did not create Ada. They held a kind of completion to find a language that would be suitable to use n all MoD and other government procurement. The idea was to get out of the situation where every vendor used a different language and they therefore had hundreds of languages in all kind of projects. Ada won that competition and subsequently it was mandated on all new government contracts. Far from being popular pretty much all programmers I worked with who had to use it did not like it. They complained it was too complex, too verbose, too slow. As a result the mandate was lifted only a few years later. With the result that everyone flocks dot the new shiny C++ as a supposed improvement over their beloved C. Ada still hangs on in safety critical systems though, like avionics. Ada never took over the world, it was rarely used outside military and safety critical applications. I get the idea that the government learned something and would not be so daft as to mandate a particular language, for example Rust. However this document certainly serves to push the software world to more reliable and robust languages that are memory safe.

[@anon_y_mousse]

@@Heater-v1.0.0 I think you missed the obvious sarcasm in that line of "took over the world", because we all know it did not.

[@michaelgreenberg6344]

No jokes about Biden and memory integrity!

[@godspeed2145]

Assuming he has memory to begin with

[@MH_VOID]

@@godspeed2145 it's just leaked over the past 80 years

[@gosnooky]

His memory is FINE, it's just his output stream buffering.

[@jackieAZ]

His memory is great, his brain just runs on Python

[@cornheadahh]

The government supporting it makes me a bit suspicious

[@virtuosisimo]

They also created the ADA programming language, that why it became so popular and took over the world

[@shallex5744]

@@virtuosisimo never heard of it

[@soniablanche5672]

CIA probably added a backdoor to the rust compiler

[@virtuosisimo]

@@shallex5744 that's my point xD

[@theproprod2118]

U r a tinhat

[@philip9186]

I'm a aerospace engineering student and write code for a satellite project. I can tell you that the institute of space systems at my uni is currently in the process of transitioning from C++ to Rust. So yes, there will soon be satellites with Rust code onboard.

[@tears_falling]

the government recommending Rust is way too suspicious maybe i should use C instead

[@robotron1236]

This comment is highly underrated.

[@y00t00b3r]

Oh, shit, is this what finally derails the Rust hype-train? "We're from the government, we're here to help!"

[@undeadpresident]

"I will defeat Donald Reagan this election!"

[@airman122469]

Yep.

[@pluto8404]

rust foundation wants to take your 🔫🔫 per the TOS. Now we know who they really are.

[@steveoc64]

Every switch, every router, every bit of Cisco equipment must now be disconnected

[@virtuosisimo]

They preffer Cisco spying them than Huawei

[@kuhluhOG]

I like Rust, but for existing projects I have a few problems with it: - integrating another build system (cargo) into an existing build system kinda sucks by itself, but it also creates another problem: porting your system module by module (instead of file by file) is really error prone and sucks even more - using Rust without cargo sucks even more than integrating cargo into an existing buildsystem (to a point where I am not sure that's even supported); but at least it makes porting an existing code base easier

[@Zwiebelgian]

I really like cargo and can‘t quite follow your problems since I‘ve never migrated a project to rust, but here‘s a trick: if you need to know what cargo is doing behind the scenes, you can use cargo build -v or even cargo build -vv. It will show you the commands run. Hope this helps

[@airman122469]

@@ZwiebelgianYeah… get back to us when you’ve tried to integrate it into a CMake or Ninja or Makefile project. I’ve done it. It sucks. It can be done, but it sucks.

[@jagagemo8141]

Ewww make files.

[@Zwiebelgian]

@@airman122469 yeah those commads are extremely verbose, good luck nonetheless. If you really want it to change, try posting a bit more formally in one of rusts official channels

[@marvin_hansen]

Build with Bazel when the project is either large , polyglot, or both.

[@Iceman259]

The “skill issue” argument is made by people living in a bubble. I can appreciate the sentiment, but the reality is that the balance of supply and demand for programmers and margins necessary for businesses to operate simply will not always allow for every programmer to be a very good™ one.

[@NinjaRunningWild]

This is a LCD defense argument. Which sounds remarkably like projection.

[@Wanderlust073]

The government operates with timelines and budgets that enterprises do not. They could absolutely establish a licensing criteria for federal dev work and create associated acceptance testing paradigms that far exceed those sustainable in private industry in the interest of national security. They literally plan to spend $20 billion to replace chinese made CRANES in our ports due to security concerns…

[@semitangent]

@@NinjaRunningWildLCD defense? As in the screen type? Could you elaborate, I find OP's argument quite compelling.

[@NinjaRunningWild]

@@semitangentDo you understand mathematics?

[@Wanderlust073]

@@semitangent lowest common denominator. In this case making an argument to defend the effort of the least skilled who posses a basic level of aptitude which is the lowest common denominator among all developers. Rather than expecting better from everyone.

[@haploguy]

A clear message that EVERYBODY should steer clear of it.

[@thingsiplay]

Everyone after watching this video going back to work doing C.

[@YandiBanyu]

You know rust made me re-think the GPL license on static link. Since rust libraries are always compiled (statically linked), I wonder if we will ever see the issue in court and set precedence.

[@ameknite]

Rust is MIT/Apache 2.0 license

[@YandiBanyu]

@@ameknite I am not talking about rust the language, but any program written in rust that MAY be GPL licensed.

[@ameknite]

​@YandiBanyu ahhh, that is not much of a problem in rust, most libraries are not GPL, the standard is MIT/Apache 2.0 and the majority check for the licenses using cargo-deny

[@heavymetalmixer91]

That's a huge license issue for certain pieces of software, not everyone wants to statically link everything.

[@Psychx_]

@@heavymetalmixer91 If you want dynamic linking with Rust, you're out of luck. That isn't a supported feature yet.

[@wesleychaffin4029]

The most aggravating part of the “skill issue” argument is that even if _you_ can write good safe c code it just takes 1 human miscommunication across an api boundary written by different people to create a CVE

[@GEfromNJ]

Another problem with the "skill issue" argument is that Apple, Microsoft, Linux, Google, etc have essentially unlimited resources and decades of experience and yet they are still experiencing these issues.

[@MikeC1]

So... Skill issues...

[@Vaalin]

Adopting Rust as a mainstream language won’t change the main factor behind code vulnerabilities: that companies do not care about security. Who cares if a class of memory related vulnerabilities is out of the equation if there’s IoT devices programmed with hard coded insecure root credentials and so on?

[@GEfromNJ]

Yeah but @LowLevelLearning discusses this in the video: 70% of major security issues are related to memory management. Even though that leaves 30%, eliminating 70% itself (after 35-50 years) would itself be a monumental achievement.

[@Vaalin]

@@GEfromNJ I don’t have data on the matter, but I’d easily bet on that figure not including social engineering as a vulnerability. So, even if we take at face value Rust’s claim to memory safety, it still wouldn’t lead to a particularly more secure digital environment. It could indeed solve a major class of vulnerabilities, but it’s also the class of vulnerabilities that only highly sophisticated attackers use, so it probably is the less frequent in volumes of attacks. A vast network of Internet crawlers brute forcing common default credentials for unsecured IoT devices is, to me, a more worrisome class of attacks, because of its scale and low floor to access it. And it’s a kind of vulnerability that can only be removed by making cybersecurity due diligence standards mandatory.

[@ultimatedude5686]

@@Vaalin In response to the claim that Rust prevents a lot of vulnerabilities, saying something like "yeah, but it doesn't prevent all vulnerabilities" is not really a counter argument. Memory safety issues undeniably make up a huge chunk of software vulnerabilities and using Rust helps to prevent those from occurring.

[@jackieAZ]

It’s almost like profit seeking behavior is inherent to capitalism

[@alexanderd.7818]

The US government declares a lot of things. If they would say that sky is blue, I’d still bother to re-check it myself.

[@keenoogodlike]

As long as human write code, flaw code always written. That's why people fix bugs.

[@Pdrum2]

I never listen to anything the government says

[@theproprod2118]

U have a hat made out of tin

[@pixelshocker7775]

I've watched several of your videos now. The topic of Rust was my gateway into your channel, but so far I've found everything I've watched to be absolutely fascinating. I have subscribed and I am actively looking forward to your future content.

[@sumpwa]

All dozen Rust developers are having a blast right now.

[@daniellundqvist2926]

Damn, those 12 programmers downloaded crates 60 billion times, while creating 141 000 crates. Very impressive.

[@landonviator4300]

13, I started learning it.

[@roberthoople]

Considering what the USA deems "good" these days, this isn't the glowing endorsement people think it is.

[@stzi7691]

Can you be 100% sure? You know the German saying: "Even a blind chicken does occasionally find a corn."

[@roberthoople]

@@stzi7691 Hahaha... True. However, I don't think this is the case with Rust. Largely because I don't think Rust is anywhere near as "safe" as people think it is. I mean, there are videos floating around now, which show people breaking the borrow checker and causing memory leaks, which most people seem to think cannot happen.

[@yandere8888]

@@roberthoople wow rust has bugs? well back to writing assembly, be sure to push ur registers to the stack before overwriting them! how is this a good point in ur mind? rust provides a lot of checks that avoid most vulnerabilities in C programs, it not being 100% effective isnt an own to it being safer

[@roberthoople]

​@@yandere8888 LOL. My actual problem with Rust are it's childish fanbois, and the diaper stink they bring to every programming conversation on the internet, not so much the language's on-by-default safety features themselves.

[@yandere8888]

@@roberthoople ah yes the adult thing of not using a language cuz u dont like the other ppl who use it what?

[@user-lp8eo5cd1h]

I've been a programmer for 40 years, 10 of which was in C/C++, and that Whitehouse paper didn't make sense to me. It jumped from saying "We need to make more secure software" to "Therefore, memory safe programming languages is the solution". I can write a program that puts passwords into a plain text file. That's a security issue but has nothing to do with memory. I can write a program that infinitely allocates memory and crashes the program. That has to do with memory, but has nothing to do with security. Then the article mentions events like the Morris Worm. The Morris Worm used "finger" to find people logged onto the computer. Not sure how that has to do with memory. I agree that Rust is better at memory management, but I'm pretty sure I can write an insecure program in it, regardless of it being better at memory management.

[@maxxroach8033]

This! And just because rust is "Memory Safe" Doesn't mean there aren't issues with it. Kinda like how Alpine Linux is "more secure" than other distros because there are fewer eyes on it.

[@C4CH3S]

You are missing the point, cherry picking these examples and cases. A lot of hardware and software gets picked apart due to memory issues and overflow. The fusee gelee exploit that made every Nintendo switch vulnerable was caused due to a memory overflow bug, for example

[@PleasePlayGoodGames]

@user-lp8eo5cd1h You are entirely missing the point and are bike-shedding. Expecting programmers to have a borrow checker in their head is inherently flawed.

[@OGNord]

@@C4CH3Sisn’t that just down to poorly managed code? With some finessing with rust you could most likely fuck with it in a similar way. It’s just not been exploited yet thanks to low use.

[@purewaterruler]

​@@OGNordusing rust makes it nearly impossible to write a huge class of bugs. You can argue "poorly managed code," but if there's an option that makes such bugs impossible without specifically choosing to use an escape hatch, then you're simply going to have less bugs. I'd rather have a complier enforce bugs to not exist rather than rely on the human to do that check, humans who miss stuff, who make mistakes. Yes you can write insecure code in rust. But it's much harder or impossible to write a very important class of bugs in rust. And even if it is possible, you have to go well out of your way to do so.

[@emptydata-xf7ps]

It doesn’t matter how safe your language is when 80% or more of data breaches are from social engineering and phishing. On the other hand, any language is safe as long as you make no assumptions about any input or write data and you have assertions in your code to check that data before any work is done with it.

[@mma93067]

It still gives us a peace of mind that we haven’t created an exploit unintentionally. Reducing the attack surface helps us target the next class of exploits. Besides it also helps us avoid unintentional memory bugs in regular use.

[@emptydata-xf7ps]

@@mma93067 rust still has CVEs. It’s not full proof and relying on the claim of full proof is the same as having assumptions about your code.

[@emptydata-xf7ps]

@@mma93067 Rust still has CVEs. It’s not a cure all, and believing it to be has the same effects as making assumptions about your inputs.

[@michawhite7613]

Sure, social engineering is the biggest problem these days, but to say that memory safety doesn't matter is incredibly hyperbolic. Even if it doesn't cover all or most vulnerabilities, reducing the attack surface by 5% is nothing to scoff at.

[@sockpastarock7082]

Actually, it does still matter how safe the language is because attacks still exist which target those insecurities of the language. Also, the idea that every language is safe as long as you do everything absolutely perfectly with absolutely zero assumptions is an overly naive solution. We already know that nobody is going to write perfectly secure code all the time. Crossing your arms and saying "well they people should code perfectly" isn't a solution.

[@user-fr3hy9uh6y]

I'm guessing that you are not old enough to remember ADA. Fourty years ago, the DoD required all new software to be written in ADA for all of the same reasons. Will it be different this time?

[@midnightfuture]

Yes. Ada came from Defense, including its design; Rust came from the developer community and is simply being _recommended_/adopted by government, among others.

[@chadm2343]

​@@midnightfutureI don't really see the difference.

[@rusi6219]

@@midnightfuture implying rust isn't heavily political and compromised from the start lol

[@manuellopez1234]

I think the Garbage Collection point is that, gb is non-deterministic

[@sleepib]

I think the issue with garbage collection is that it can unpredictably change how long it takes code to execute, which is a problem for a real time system.

[@ewilliams0305]

My dad worked for NASA from 70s-late 90s working on Space storage systems. He had to create his own language to do the things (and presumably to adhere to those guidelines).

[@lepidoptera9337]

Your Dad was smart and knew that the only way to be "safe" in certain ways was to give up on Turing completeness. One can afford that for science and aerospace systems, but it's a rather hard way to make a living as an app programmer.

[@Uerdue]

It may very well be a skill issue, but that doesn't make the problem go away!

[@nnaaaaaa]

C and C++ are memory safe, but your code may not be. rust's stdlib worries me more than strcpy does because very few stop to consider maybe the code isn't safe since even though they can't see any "unsafe blocks".

[@delibellus]

In one sense, C is neither memory safe nor unsafe, because that's in the hands of the programmer. On the other hand, if the security problem is located in the possibility of making unsafe programs, then C itself can be considered unsafe.

[@kenneth_romero]

be pretty cool if you did a retrospective of malware/exploits in the history of computer science. be able to compare the knowledge back then to now, and even the limitations of why such exploits were made/discovered

[@thomasatkins]

If i recall correctly heathcare devices typically also have constraints on using garbage collected language. I think in both cases it is the issue of lossing control over when/the interval between code execution as with garbage collected languages you dont know when it will be run or how much garbage needs to be processed

[@Megararo65]

The white house: Rust is safe! Cve-rs: ...Do you even know what you are talking about?

[@AmirHosseinHonardust]

There is one crate that demonstrates that it is possible, though not common to have memory vulnerability in safe rust, if you try really hard. On the other hand, best C programmers, even when trying really hard, release software with these vulnerabilities on daily basis. So I think, Rust is safe for now.

[@tylerfusco7495]

i mean, your average rust programmer is not exactly using HRTBs in their code lmfao

[@undeadpresident]

"the white house said it, it must be true! Everything else is disinformation! Censor it!"

[@diadetediotedio6918]

Rust is generally safe, what CVE-rs did is very, very, very specific AND what they did it is catched by MIRI (which you should be using if you are trying to make your software the safest as possible with the language). It is also a problem that can be fixed, so it eventually will. Of course I'm not saying it is not bad, it is pretty bad, but still, edge cases does not removes the benefits on security of the language.

[@godspeed2145]

@@diadetediotedio6918 "eventually", sure

[@jesselawrence336]

Zig has placed itself nicely to replace legacy C and C++ code. It'll be interesting to C how it competes with Rust in this space

[@samuele5931]

Never heard of it in real life: so competition currently non-existant.

[@jesselawrence336]

@@samuele5931 tuple is one example. Zig ships with a compiler that can compile C and C++, its memory safe and simple so I think its a pretty strong competitor because of the way it sets it self up for rewriting legacy C and C++ codebases. It would be simpler to rewrite in Zig than Rust

[@dranon0o]

@@samuele5931 Bad take Uber use it My company use it and we're responsible for a very popular software to manage datacenters and servers

[@cytosolic5303]

I agree. If Zig continues to perform and stabilize, I think it will start replacing C, and maybe some low-level C++ areas like games/graphics. Rust will need to compete with Golang to pick the corpse of C++

[@psmittyispy]

You say it isn't a skill issue, and you also jumped on the 2019 metric of 70% of bugs are "memory bugs", but neither get at the root of exploitation. 1. What is the most common vulnerability type exploited by hackers? Is it memory bugs? Or is it misconfigurations and user error (skill issues). 2. Do you agree the barrier to entry in software development has been reduced in the last 50 years allow people with maybe less skill to develop and release software (skill issues)?

[@christopheriman4921]

For me it isn't about whether or not it is or isn't a skill issue because if you do anything wrong ever it could be considered a skill issue. I think that having a language that nearly completely prevents certain kinds of skill issues releasing in working production code is a good thing.

[@The1Jebrim]

Hard real-time safety/mission-critical systems not only do not use a GC, but they don’t use dynamic memory allocation either. Doing this eliminates a wide number of memory safety bugs, whilst also more easily achieving deterministic timing. Static memory allocation is a paradigm that really ought to be used more often tbh.

[@siamesestormtrooper]

12:02 is the first time Rust is mentioned in case anybody wanted to know

[@BurninVinyl]

So the list includes: Java, Go, Python, C#, Swift. - KlausGean

[@esra_erimez]

This is very interesting to me since the firm I work for takes a security first approach to everything we do. From the air gapped networks to the application code.

[@Walter_]

Is it smart to post this information to the internet?

[@esra_erimez]

@@Walter_ If we do our jobs right

[@BufordTJustice42069]

Some say "Rust toolchain", others say "NSA backdoors". To-MAY-to, To-MAH-to.

[@samuele5931]

Better NSA backdoor than colander backdoor. No?

[@rusi6219]

​@@samuele5931 you glow

[@defnlife1683]

I'm glad. Just wish the syntax was simpler, like Go or Pascal. Just wish they adopted the C philosophy of adding features every 30 years instead of every 3 months lmao. C got presdefined bool types the other day... in C 23. We'll be using that in like 2084. (granted it had bools before, but not as part of the spec)

[@combatcorgiofficial]

“50 years later in a world of C with all these improvements to security how are we still writing vulnerabilities” Devs, not using any of the improvements to security:

[@diadetediotedio6918]

Thus, moving into a new language that offers it out-of-the-box appears to be a good 'solution' for this.

[@combatcorgiofficial]

@@diadetediotedio6918 lmao no thanks

[@zaper2904]

"What's a unique pointer?" ~ most people who shit on C++ for being unsafe.

[@user-sb5vt8iy5q]

​@@diadetediotedio6918One of the reasons I like rust more than C is cargo, it's so nice to have a built in build system that just werks and doesn't use archaic scripting languages, I never have to search for libraries and compare which one is better at what, just cargo add tokio, done, multithreading

[@sockpastarock7082]

Exactly. Devs don't use them. Unless it's "built in" they will continue not to use them. We have 50 years very clearly demonstrating this is the case. That's why languages which are more memory safe by default are generally better for ensuring everyone is producing secure applications. Especially when we, as users, are often forced into using proprietary software built by developers we've never met. I'd prefer that they have some decent guard rails when writing programs that are responsible for handling my personal data.

[@DegradationDomain_stuff]

I can't wait to look at cyber security issues in an OS written exclusively in Rust

[@ian562ADF52E]

SOC analysts just got even worse at our jobs

[@cusematt23]

Didnt think Biden knew this much about computers damn

[@DNA912]

why build fireproof houses? seems like a skill issue if you set fire to it.

[@rusi6219]

If you lean on a motorbike you'll crash

[@adrianmizen5070]

Because making a house truly fireproof is mad expensive and has negative side-effects. It's much cheaper and better to teach the occupants how not to set the house on fire.

[@owlmostdead9492]

It’s a skill issue, most people are not smart, behind all jobs are people = you can guess the rest

[@afgor1088]

i guarantee you are a sub par programmer.

[@owlmostdead9492]

Sure and I can guarantee you’re one as well, which just proves my point. The difference between me and you though is that I don’t think it’s impossible for me to be trash at something

[@NinjaRunningWild]

@@afgor1088 Projection. Thanks for confirming. Also, ad hominem. We accept your surrender.

[@dranon0o]

It's such a bad take When we will have to manage legacy code of Rust people will be very confused and very unproductive I rather stick to Go and Zig

You can write safe c using a lot of static analysis and testing. However, there are not many developers with the ability and know-how. I know only a few developers who write safe code with c, and companies are unable to find additional capable people with good coding practices. When you draw the line additional effort usually does not make financial sense, which is why rust is on my to-do list, to write optimised safe code in one step without Misra checks analysis and weeks of testing.

[@MattDog_222]

I remember reading somewhere from Oracle I think that Java should not be used in space

[@anon_y_mousse]

In space you need realtime operations. You can't have that with a GC.

[@ekmekdelikanli1408]

If NSA and White House says you should use something, it is better not to use it.

[@danm524]

If the NSA and WH said to breathe air are you gonna hold your breath

[@ekmekdelikanli1408]

@@danm524 yes.

[@danm524]

Shook. Need the NSA and WH to approve junk food, praise social media, and hate on voting then.

[@yandere8888]

@@ekmekdelikanli1408 r u still holding ur breath

[@baileycownley1868]

Be honest, even if they took the White House report as marching orders; Main problem is infrastructure not being updated as there's no money nor incentive for your manager to order new equipment/software. A Rust ecocircle will still be decades away from a hospital running on Vista PCs

[@EmbeddedSorcery]

"Skill issues" is not a response from engineers who are actually doing things. Engineers think in terms of system design, and if a better system can be made to avoid issues.

[@malusmundus-9605]

Changing to Rust will not stop cyber-crime. I want people to know that. It can help increase security generally, but it cannot change the dynamic we currently have. Black-hats will always have the initiative. We should, at the very least, recognize that programming is an art, and preserve the use of "unsafe" languages for use in environments where safety isn't a concern (such as offline, single-player video games). If the government wants to use Rust, let them have it. If they demand it for browsers and internet-related code, then so be it. They should not interfere with the freedom to use and create languages.

[@YandiBanyu]

I am more concerned that rust is also being used to create malware/exploit

[@malusmundus-9605]

​​@@YandiBanyu oh it is, and will continue to be (there are already "hacking" courses that use Rust on youtube). You can't touch hardware without security concerns. Unless the government wants to rebuild everything from the ground up, it will continue to be that way.

[@jongeduard]

@@YandiBanyu Which is even more reason to use Rust for the possibly targeted good software as well, as a counter measure.

[@YandiBanyu]

@@jongeduard I am not saying do not write software using rust. Both can exist at the same time. I am merely pointing out that malware too can be created using rust.

[@jongeduard]

@@YandiBanyu Oh no problem, I did not think or intent that either. I just emphasized the importance. I actually liked your comment instead.

[@Kani8122]

"The US government promotes Rust." Wtf I hate Rust now.

[@sandrin0]

"reactive" and "reactionary" mean very different things in case you didnt know (though describing security researchers as reactionary is kinda funny, and maybe a bit accurate too)

[@Michael_L_]

They forget about Ada, which is memory-safe when used in certain profiles. The Boeing 777 still flies on Ada.

[@jonathanmoore5619]

Probably the worst recommendation you could possibly get.

[@qinlingzhou8815]

WH? Does Biden have memory?

[@PS3PCDJ]

You can write secure software in almost any language, but most people don't know or don't care about writing safe code. Just the fact that a lot of seasoned programmers that I've seen trying Rust, struggled with borrow-checker, that shows that they fundamentally don't know how to write critical software correctly.

[@tconiam]

Ada enters the room (and locks the door behind it) Multi-threaded, type safe, and memory safe since 1983.

[@romangeneral23]

Rust still sucks. And the U.S. government calling it out to use it just proves that it does indeed suck. It's not C and C++ fault that the developers of such cyber security systems didn't know how to use the language and just slapped together whatever it took to get the paycheck...

[@rusi6219]

Exactly -- lousy coders do not become good by being given safer toys. If anything, this will result in even more bad code due to the perceived "safety".

[@romangeneral23]

@@rusi6219 Thank you. Perfectly Said!!!

[@allesarfint]

You will use Rust, and you'll be happy.

[@litaxc]

So according to NSA, Rust is one of the memory safe language along side with C#, Java, Ruby and Swift lol

[@erictrinque6513]

I like that President Biden is backing memory safety. Make Irony Great Again

[@Joel-zi6pt]

Wdym It can't be a skill issue if it's been going on for 50 years? It's not like the same 10 people have been building all the software for 50 years.

[@tirushone6446]

The problem is saying "it's a skill issue." is even if you are a super skilled programer, you will eventually make a mistake, the borrow checker on the other hand, will not.

[@igoralmeida9136]

"borrow checker on the other hand, will not" sounds like a religious dogma

[@chinoto1]

​@@igoralmeida9136I guess there's a slim possibility that the borrow checker would allow code that it shouldn't, but so far I've only ever heard of it being overly restrictive, which I'll gladly take over manual verification.

[@zaper2904]

@@chinoto1lookup cve-rs.

[@chinoto1]

@@TapetBart My other comment disappeared. Shortly after my first comment, I looked into cve-rs, which escapes the borrow checker. Funny how I found it so quickly after my erroneous comment.

[@tirushone6446]

@@igoralmeida9136 I mean it's an algorythem, and it has rules that prevent data races and use after free's, so therefor, it does make make mistakes, because it isn't a human, idk what universe your in where this is religous dogma.

[@1vader]

To be fair, while companies defintely rarely put enough money and effort into security, there still also are a lot of bad devs or devs that just don't really have a clue about security (and to be fair, some issues can be quite surprising and hard to spot if you're not familiar with them). Although that ofc still means, we should give them tools that make it difficult to make these mistakes in the first place.

[@wavewalnut9869]

We need to know secure way to do something, not only with language to write code but also algorithm how to resolve each problem.

[@carver64]

The White House can't even decide which bathroom to go to.

[@academai11]

MASA Make America Secure Again

[@undeadpresident]

maybe try dealing with the corruption first starting with the financial system

[@effsixteenblock50]

The biggest issue with any processor in space is that Two's Complement completely sh1ts the bed when passing through the Van Allen radiation belts.

[@no_name4796]

Well Rust compilation times, are on par with the US burocracy, no wonder they love it ;-)

[@georgerogers1166]

C++ is even worse in that regard.

[@no_name4796]

@@georgerogers1166 in c++ you don't need to compile every single dependecy though although, linker errors are one of the easiest way to go crazy lol

[@0x90h]

@@georgerogers1166 Compilation speed is not about language, it is about compiler.

[@georgerogers1166]

@@0x90h c++ is inherently slow compiling when using templates. Multiple whole program compilation.

[@charlieking7600]

​@@0x90hit's still about the language, the C/C++ header system slows down process noticeably. That's why C++20 has modules support - to speed up compilation.

[@Terrados1337]

"Use memory safe languages" is code for "have somebody else write your compiler so you can blame them when your calculator app leaks nuclear codes".

[@ultimatedude5686]

Is the alternative to build your own compiler from scratch? I don't really understand this argument.

[@Terrados1337]

@@ultimatedude5686 you fell into internet falacy 17: assuming something is an argument. And falacy 18: assuming it was a personal attack against you. And falacy 19: being offended by it. I was merely poking fun at the idea that delegating responsibility automatically yields better results.

[@ultimatedude5686]

@@Terrados1337 I was using the word argument very loosely. I didn't find what you said offensive, I just disagreed with the point you're making. Delegating responsibility to much larger and more well-maintained codebases (like the compiler and the standard library) is generally a good idea.

[@matthias916]

the thing i dislike most about rust is that its managed or whatever you like to call it by a single entity, i feel like with c thats kinda different, theres tons of c compilers out there which just makes it feel less commercial for some reason

[@tiranito2834]

Because you are literally allowed to write a C compiler if you want. With Rust, I'm not so sure, it's trademarked so making a compiler and saying its for the Rust (TM) language might as well get you sued these days.

[@clairel34]

​@@tiranito2834??? The rust compiler is OS, obviously. There are alternative ones, there just isn't reason to use them yet. If there's ever issues with rustc obviously it will be forked and a new one will be the default compiler choice, if there's demand for it.

[@adrianmizen5070]

@@clairel34 Except you can't call it a Rust(TM) compiler without permission.

[@ragectl]

Memory safe hardware tends to be devices that enforce ECC checks. Linus Torvalds called out Intel for being a major reason ECC memory isn't common

[@stifflery]

That only saves us from data corruption from high energy cosmic radiations.

[@soko45]

Hey, maybe the topic of the upcoming NIS2 directive might be interesting for you. It's not about secure software per se, but more so about secure systems and holding CEOs liable

[@willemvdk4886]

But, but, what about Zig?

[@nobiado484]

Exactly! That just shows that the paper is not about "memory safety" but just used this buzzword because it's what Rust is selling. I don't know what is going on, but there's something very weird about the entire Rust hype. And the government taking sides like this just makes it even weirder.

[@ric8248]

The White House wants you to use Rust. What better reason to use C++?

[@climatechangedoesntbargain9140]

C++ is more adventurous

[@godspeed2145]

Calm down Zelensky, you're not getting any more money

[@ric8248]

@@godspeed2145 ??? 🤔

[@MoonSt0n3_]

I agree about safety not being a skill issue. I'm all in for using Rust instead of C++. But to what level do you think that we have to constrain programmers? If programmers don't follow secure code guidelines and standards, there can always be security issues. Memory safety is not the only issue. Of course it's a big one. But what about the other issues?

[@jklax]

The only rust Joe knows is in his joints and brain cells.

[@undeadpresident]

and maybe his bicycle too

[@tiranito2834]

@@undeadpresident I think he's more familiar with the pavement.

[@user-gh4lv2ub2j]

This is the same whitehouse that has done WHAT over the past 4 years? Confirmation rust is trash!

[@sockpastarock7082]

It would be the same one that patched the encryption algorithms we all used decades (literally 20 years) before any academics understood the vulnerabilities that they were patching. The same one that hacked into a secure Iranian nuclear enrichment facility and covertly deteriorated the equipment using an autonomous malware worm released onto the open web. I think they know a little bit more about secure code than you do.

[@aneeshprasobhan]

they 100% found back doors

[@edgeeffect]

Erm.... if The White House says anything is good... my first thought is that it must be awful.

[@egonkirchof]

Code should be checked and tested so that it has no unintended behavior.