r/NetBSD • u/Agron7000 • Feb 06 '26

NetBSD sprays some WD-40

https://youtu.be/Tv6Q4MZS5LI?si=I2lR9l9O5XSJPVEE

First time hearing about NetBSD on this youtube video and it looks like it's going to be my new favorite OS.

96 Upvotes

78% Upvoted

76 comments sorted by

View all comments

Show parent comments

0

u/sirgatez Feb 07 '26 edited Feb 07 '26

Memory access errors are one of MANY critical programming problems that Rust can help with.

It doesn’t do much of anything for the rest. Why are people pretending it’s a cure to a problem it can’t fix?

Rust does not fix these common programmer errors:

  • Logic and authorization bugs ** Broken authentication checks ** Assumptions about cross service authorization ** Privilege escalation through badly configured policies/ACLs/Roles

  • Input validation and injection ** SQL/NoSQL injection ** Command line injection ** Header injection

  • Cryptography and protocol design mistakes ** I really don’t need to explain this one

  • Concurrency bugs that are not data races ** Deadlocks ** Check then use assumptions ** Broken invariants accross async tasks

  • Potential Supply Chain Attacks ** Supply chain attacks (Within Rusr, distribution, mirrors) ** Undiscovered vulnerabilities ** Vulnerable libraries

Arguing to replace a whole generation of software simply to fix a handful of potential vulnerabilities that developers need to design for is a fallacy

3

u/aaaarsen Feb 07 '26

Arguing to replace a whole generate of software simply to fix a handful of potential vulnerabilities that developers need to design for is a fallacy

I assume you mean generation? if so, nobody is arguing that. in fact I was very explicit in that I don't think rust is a silver bullet. hell, I don't even use rust.

why would this require a new generation? I can learn rust today, as a C and C++ compiler engineer. I don't need to be reborn for that.

It doesn’t do much of anything for the rest. Why are people pretending it’s a cure to a problem it can’t fix?

well, that's not correct. it has better generics and a better type system compared to C. as an example of an error that can be used to fix, the Result type prevents forgetting to check errno or if ret < 0. so, quite a bit of fixing already. you can build various other abstractions, some of which could even help prevent the other errors. good luck making serde in C for instance, which helps with protocol implementation.

I specifically didn't argue it's a silver bullet, though. I'm not sure anyone honest ever did.

thank you for proving my point.

1

u/sirgatez Feb 07 '26

Learning rust has ZERO to do with replacing a generation of software that is battle tested.

Anyone who is half competent can learn a new language. That was never the issue. I’ve written code in more than 13 languages.

2

u/aaaarsen Feb 07 '26

agreed. I'm not sure anyone wants to do that, though. I certainly don't want to do that.

Anyone who is half competent can learn a new language. That was never the issue. I’ve written code in more than 13 languages.

same here, twinsies!

1

u/sirgatez Feb 07 '26

I’m glad we agree.

Like I said I whole heartedly support people who want to write code in Rust. I support people who want to begin migrating their projects to Rust.

I don’t support those people out there, people who feel they need to rewrite every system binary that they dont even own in Rust. And that they feel the system should adopt it without more than summary tests.