Re: Fwd: [friam] Could you/somebody make a safe browser?

On Fri, April 10, 2015 08:07, Tony Arcieri wrote:
> On Thu, Apr 9, 2015 at 11:04 PM, Rob Meijer <rmeijer-qWit8jRvyhVmR6Xm/[email protected]> wrote:
>
>> While I do think Rust is a really promising language, 'modern' C++ style
>> programming already solved most of the accidental C style C++ memory
>> insecurity bugs.
>
>
> If you think this, you really need to subscribe to the Apple SA list.
> Every
> single Apple SA since (the dawn of time?) has included at least one WebKit
> RCE.
>
> This is effectively a No True Scotsman fallacy: no true Scotsman handles
> memory unsafely in C++. Not today, surely! Not with modern C++ programming
> techniques!
>
> Empirical evidence suggests otherwise.
>

Most C++ security bugs are still bugs resulting from a rather C-ish C++
programming style. When you write C style C++ you get C style bugs.

Unfortunately some big companies use horrible C++ coding guidelines that
actually contain elements that lead to memory safety and error robustness
safety nightmares, and at least one of them is actually a big browser
manufacturer.

Consider this:

* Take the insecure C++ code
* Rewrite it in Rust
* Port the Rust code back to C++

Is the security bug still there?

Chances are it isn't. Rust forces you semantically to write in a style
with unique_prt and friends, RAII, etc that many experienced C++
programmers have gravitated to already and that doesn't suffer from the
memory safety related bugs that classical C++ did/does.

Yes, memory safety remains an issue that needs to be solved in order to
solve the bigger problem of large trusted code bases. Without addressing
runtime and standard library ambient authority POLA issues however,
'fixing' just memory safety isn't going to help as much as you and many
others seem to be imagining.

Rust by itself is an improvement over C++ due to the fact that it forces
good style on its users that C++ doesn't (while providing convenient
syntax for doing so). Many people use such a style already in C++ but many
bugs result from people not adhering to what is commonly considered modern
safe C++ programming style, but its not mandatory in C++. Rust could
however be so much more than decently written C++ if Rust could be purged
of its ambient authority components and APIs IMHO. If Rust could be
converted into an ocap language maybe.


> --
> Tony Arcieri
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>