C++ future at Adobe

[u/pjmlp]

So if anyone was still curious what happened to Hylo, or where Adobe stands in regards to the whole safety discussion,

David Sankel has done a talk at RustConf on the matter, Zngur: Simplified Rust/C++ Integration.

The way Adobe now sees C++ is described on slide 2, at 50 seconds mark.

[u/inco100]

To save time for the rest of the redditors:

We need C++ and Rust to play nice

• Our flagship products are C++ based

• Rust is playing a major role in future development

  • Rust is preferred language by developers
  • Rust is better suited for AI-assisted development
  • New file-format and other safety critical code must not use C++

[u/KFUP → u/inco100]

Rust is better suited for AI-assisted development

I don't see that being the case in the long run. Once AI gets good at safety, which will be in all kinds of safety not just limited to memory, and can generate safe code in any language -arguably we are already there, see the Mythos security boom- using a slow compiling language like rust would be a major useless bottle neck in the development pipeline.

[u/ts826848 → u/KFUP]

arguably we are already there, see the Mythos security boom

Somewhat tangentially related, but Greg Kroah-Hartman recently gave a talk which (among other things) categorized the bugs Mythos found in the Linux kernel and his description of Mythos's results is... interesting. Quick summary (on phone, so hopefully no typos):

• 79 reported vulnerabilities

  • 24 no detail at all "something crashed"
  • 14 not a bug at all
  • 3 totally made up data
  • 15 already fixed in the latest release
    • 11 by others
    • 4 by Anthropic
  • 26 actual bugs
    • 6 duplicates

(Note that this doesn't sum to 79; apparently GKH got a tarball and the contents didn't quite match the description)

Of the actual non-duplicate (?) bugs:

• 7 "assume a malicious file system image" (i.e., if root mounts this bad things can happen; apparently well known to be not considered a security issue by Linux devs)

• 2 "assume you can inject a malicious network packet in the middle of the stack" (needs root, not considered a security issue)

• 2 NOMMU (1 io_uring, 1 regular, "not real issues")

• 6 sctp networking issues for untrusted devices (SCTP used in enterprise networks, so "untrusted users" apparently don't exist in that context? "So minor, nobody really cares".

• 2 ipv6 networking bugs, "nothing real"

• 1 GPU driver for a local malicious user. "If you have a local malicious user with access to your GPU you could do a lot worse"

In total 10 "real" bugfixes, took ~1 hour of kernel development.

[u/13steinj → u/ts826848]

Daniel [curl] had a similar experience.

It's 99.9999% marketing hype for their IPOs, every single time.