[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <22398fb96f04bf431b3ed0e4778e1cfcd64046ea.camel@orlitzky.com>
Date: Fri, 29 Sep 2023 09:16:21 -0400
From: Michael Orlitzky <michael@...itzky.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2023-5217: Heap buffer overflow in vp8
encoding in libvpx
On Thu, 2023-09-28 at 16:42 -0400, Demi Marie Obenour wrote:
>
> How long will it take for corporations to accept that writing media
> codecs in C, C++, or any other memory-unsafe language is a fundamentally
> bad idea, and that it is better to rewrite the codecs in a safe language
> (such as Wuffs or Rust) than to try to secure the existing ones?
How long will it take for rust to quit changing the language,
standardize itself, and enforce some notion of API/ABI stability? The
thing we've already had with C and C++ for decades? As a result of the
language's instability (and their attempt to hide it with a "package
manager"), every rust package wants to install a gigabyte of bundled
dependencies that are all pinned to old versions.
Software engineering is a fractal. Memory safety inside a language is
obviously desirable, but not if other design choices force everyone to
go back to bundled libraries and static linking. The state of rust is
that it's fun to write, but awful to use. If you want me to switch from
C to another language, then projects written in that language can't be
a nightmare to distribute and maintain.
The situation is identical to how, ten years ago, we were going to
rewrite everything in Haskell. Haskell has the same pro/con list as
rust. But they never figured it out either. Every new release broke a
ton of code, and so version constraints became so tight that you
couldn't install more than a few programs at once without bundling. The
resulting treadmill was never-ending. Once "this is cool!" wore off,
everyone was left with "this is a waste of time."
Maybe someone at $corporation has figured out that rust is wasting
their time.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
