Conversation

Tired: Rust kills memory corruption as an attack vector

Wired: C kills supply chain compromise as an attack vector

0
1
1
the humble xz:
1
0
0

@novenary yeah c means that you get a few absurdly large kitchen sink libraries instead

1
0
1

@charlotte @novenary it counted how many crates were in openssl and it's like,,, 30?

an argument can be made that having less authors (regardless of the size) is good, at least against malicious code (it will do nothing against bad code). which it would largely agree with. "blessed" rust crates that fall under rust-lang/ and has third party reviews and such are also not a bad idea

also, Yeah, bootstrapping rust is fun but so is bootstrapping a C compiler. both are largely solved problems though, just one costs a Bit more compute than the other.

1
0
1

@5225225 @novenary bootstrapping a rust compiler is imo easier and involves less ancient software. in either case the bootstrap path only exists for X86_64 but i think adding non-x86 support to mrustc is easier than some 15-20 year old gcc versions

1
0
0

@charlotte @novenary true. you need a functional C++ compiler to get to mrustc, so you do need to solve both, but my first impression is once you have that, it's just annoying in terms of compute, not "it's technically hard to do"

mrustc seems to only officially support x86_64 but it seems like it's not that hard to add support for other arches, someone already added risc-v from the looks of it, and there's mentions of powerpc ports.

hydra yearns to have a 20 long chain of rustcs to build in order to provide a current rustc (which wouldn't really be That long, you'd just want to be Careful about not introducing spurious rebuilds to it. building 20 rustcs once a year is fine, doing it once a week would be annoying)

2
0
1
@5225225 @charlotte @novenary
> hydra yearns to have a 20 long chain of rustcs to build in order to provide a current rustc (which wouldn't really be That long, you'd just want to be Careful about not introducing spurious rebuilds to it. building 20 rustcs once a year is fine, doing it once a week would be annoying)

Im annoyed that nix can't use a previous nixpkgs revision(with binary substituters) for compiler bootstrapping, it seems like a perfect use case for nix
1
0
1

@Mae @charlotte @novenary i don't think that's much different from just never changing any of the inputs to the bootstrap builds.

and needing like 20 different nixpkgs tarballs checked out in order to do a rebuild of rustc (without relying on the binary cache) would get annoying.

0
0
0

@5225225 @novenary rn it’s only an 8 long chain, mrustc does keep decently up to date with rustc updates at this point

0
0
1