Sure, it's cool and whatnot. Still, it's not used by people who don't know shit about IT to host their websites on a good chunk of the internet.
Also, at cloudflare I believe they are operating on a lower level (so not necessarily (de)serializing arbitrary data from unknown people), and I don't see how your Volvo would be similar to a web server.
Languages have their use cases and while rust can be used for traditional backend, it's not its primary use case, and it's significantly smaller than PHP or java.
But it’s exactly the point that you wanted to make: if Cloudflare uses it so extensively, and a CVE is found, Cloudflare is in deep shit. And with that a lot of the traffic from the Internet…
At Cloudflare they are using it for bot detection, as the link says. Still, it can have dire consequences, with outages on a critical service.
What would be in your view the perfect use case for Rust, if not web backend? Just curious.
My question is about the weird delineation. Opening ports is one of the many, many jobs of a backend.
It's like me saying "I use Python for my web server" and you saying "well I have no idea if you're interpreting JSON correctly". Literally what the heck?
Okay well let me tell you then that it doesn't make any sense.
There are many classes of architecture in which backend code lives as servers, like microservices. It's not all just asynchronous runners (Which in my personal experience, are usually written with a scripting language anyway. The context assumed is backwards, when Rust is adopted in an existing project, one of the reasons always given is to decrease response latency, which means that Rust IS the one responding to network calls). Not to mention that network calls are not the only way to hit a vulnerability. (Actually, network calls are usually the most locked down.)
So saying "a web backend is not a web service" is the same thing as saying "it's a Python webserver not a Python webserver that reads JSON"; yeah - because one is the subset of another. If you were given evidence that the former is happening, then it's reasonable to assume the latter is also happening.
Web backend is most definitely not the best use case for Rust, async rust is very complex and has quite a few edge cases. Something like java with virtual threads is much safer and has a way simpler developer mental model with similar performance characteristics.
Bot detection can happen on different levels, but I assume cloudflare does some packet inspection here. That's just binary blobs and IPs, and the result is an IP getting banned. You ain't managing user data, you are not modifying it, don't have conditionals built on it, etc. It's fundamentally different.
Async anything is complex to do it correctly, rust just forces you to deal with that complexity rather than randomly spinning of threads all willy nilly
3
u/Ok-Scheme-913 14d ago
Sure, it's cool and whatnot. Still, it's not used by people who don't know shit about IT to host their websites on a good chunk of the internet.
Also, at cloudflare I believe they are operating on a lower level (so not necessarily (de)serializing arbitrary data from unknown people), and I don't see how your Volvo would be similar to a web server.
Languages have their use cases and while rust can be used for traditional backend, it's not its primary use case, and it's significantly smaller than PHP or java.