In Rust We Trust: Microsoft Azure CTO shuns C and C++
- Reference: 1663697765
- News link: https://www.theregister.co.uk/2022/09/20/rust_microsoft_c/
- Source link:
On Monday, Russinovich urged the technology industry to leave C/C++ behind. "Speaking of languages, it's time to halt starting any new projects in C/C++ and use Rust for those scenarios where a non-[garbage collected] language is required," he said. "For the sake of security and reliability, the industry should declare those languages as deprecated."
Speaking of languages, it's time to halt starting any new projects in C/C++ and use Rust for those scenarios where a non-GC language is required. For the sake of security and reliability. the industry should declare those languages as deprecated. — Mark Russinovich (@markrussinovich) [1]September 19, 2022
Russinovich's dismissal of C/C++ arrives as Linus Torvalds, the creator of Linux, has [2]reportedly confirmed that Rust code – barring unforeseen circumstances – [3]will appear in version 6.1 of the Linux kernel , [4]a much-anticipated milestone . The Linux kernel is [5]written in C with some assembly and some glue scripts sprinkled in.
Rust, designed by as a hobby by Graydon Hoare, started taking shape at Mozilla in 2006 and debuted publicly in 2010. It began to attract serious attention as an alternative to C/C++ in 2015 with the [6]release of Rust 1.0 .
[7]
Since that time, Rust has been the most loved programming language in the annual [8]StackOverflow Survey seven years running – despite its reputation for being difficult to learn – and has been integrated into projects at major technology companies.
[9]
[10]
Apple, Amazon, Google, Meta, and Microsoft, among many others, use Rust in some capacity or [11]in production . Cloudflare recently [12]gushed about Pingora , its new HTTP proxy built using Rust, which has boosted performance and reduced CPU and memory usage.
Rust seems less prone to potential memory corruption bugs and this makes software less vulnerable. Microsoft has been [13]talking about dumping C/C++ and exploring Rust at least since 2019 and has been developing its own cloud-oriented memory safe programming language called [14]Project Verona . So Russinovich's call to deprecate C/C++ is not without precedent.
[15]
According to Microsoft, [16]about 70 percent of the CVEs it has patched since 2006 are due to memory safety issues. Eliminating those bugs would dramatically improve software security while reducing the cost of vulnerability remediation.
The Register asked Microsoft whether Russinovich's recommendation is being adopted company-wide. Redmond declined to comment.
Rust alone will not guarantee software is secure. It provides a defense against memory safety bugs but does not eliminate other classes of vulnerabilities.
[17]Linux luminaries discuss efforts to bring Rust to the kernel
[18]Linux 6.0 debuts, missing some Rusty bits and a magic mushroom reference
[19]Linus Torvalds releases Linux 5.19 – using Asahi on an Arm-powered Mac
[20]Linus Torvalds says Rust is coming to the Linux kernel 'real soon now'
As the language documentation [21]explains , "Rust contains both a safe and unsafe programming language." Developers may choose to write [22]Unsafe Rust for certain tasks and they may create unsafe code unintentionally. And Rust does not address attack vectors that are beyond the scope of sound software design like social engineering. Nonetheless, it has qualities that recommend it.
"Rust continues to grow in popularity for its security, speed and reliability, and it is encouraging to see this support from such prominent leaders in this field," said Rebecca Rumbul, executive director and CEO of the Rust Foundation, in an email to The Register . "We hope that this kind of support ultimately drives investment in Rust infrastructure and in the talented Rust community, so that Rust can continue to be safe, secure and sustainable for the future."
[23]
The Register asked Bjarne Stroustrup, creator of C++, to comment. We'll update this story when we hear back. ®
Get our [24]Tech Resources
[1] https://twitter.com/markrussinovich/status/1571995117233504257?ref_src=twsrc%5Etfw
[2] https://www.zdnet.com/article/linus-torvalds-rust-will-go-into-linux-6-1/
[3] https://www.theregister.com/2022/09/16/rust_in_the_linux_kernel/
[4] https://www.theregister.com/2022/06/23/linus_torvalds_rust_linux_kernel/
[5] https://www.kernel.org/doc/html/latest/process/programming-language.html
[6] https://blog.rust-lang.org/2015/05/15/Rust-1.0.html
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yyo38SFVzkctuCeyAheEZwAAANY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[8] https://survey.stackoverflow.co/2022/#technology
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yyo38SFVzkctuCeyAheEZwAAANY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yyo38SFVzkctuCeyAheEZwAAANY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://github.com/omarabid/rust-companies
[12] https://blog.cloudflare.com/how-we-built-pingora-the-proxy-that-connects-cloudflare-to-the-internet/
[13] https://www.theregister.com/2019/07/18/microsoft_rust_security/
[14] https://www.microsoft.com/en-us/research/project/project-verona/
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yyo38SFVzkctuCeyAheEZwAAANY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[16] https://github.com/Microsoft/MSRC-Security-Research/blob/master/presentations/2019_02_BlueHatIL/2019_01%20-%20BlueHatIL%20-%20Trends%2C%20challenge%2C%20and%20shifts%20in%20software%20vulnerability%20mitigation.pdf
[17] https://www.theregister.com/2022/09/16/rust_in_the_linux_kernel/
[18] https://www.theregister.com/2022/08/15/linux_60_debuts_missing_some/
[19] https://www.theregister.com/2022/07/31/linux_5_19/
[20] https://www.theregister.com/2022/06/23/linus_torvalds_rust_linux_kernel/
[21] https://doc.rust-lang.org/nomicon/meet-safe-and-unsafe.html
[22] https://doc.rust-lang.org/nomicon/what-unsafe-does.html
[23] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yyo38SFVzkctuCeyAheEZwAAANY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[24] https://whitepapers.theregister.com/
If it is good enough for Linus then...
it should be good enough for Azure.
But... will that tin of Hammerite paint I have in my garage stop 'rust' from spreading? (only joking)
...been developing its own cloud-oriented memory safe programming language called Project Verona.
I'm sure that somewhere they must have a Wheel Research & Development Lab.
Hold your horses!
-> Rust seems less prone to potential memory corruption bugs and this makes software less vulnerable.
It only makes rust programs less vulnerable in those areas. It does nothing to stop bad programming in general, and there are plenty of bugs around like that. Does it stop hardcoded credentials being part of a program, AKA a common Cisco bug? Can a rust function be written to return true even if it doesn't actually do anything?
Re: Hold your horses!
Tooling to prevent credentials from being hardcoded does not need to be language-specific. I work at Microsoft and we have such tooling baked into our processes. You have to run these checks before anything hits the field. There are plenty of similar tools available in the community.
As for useless functions in Rust, I'm not sure, but the compiler is very good at spotting when something is not used.
Just in case you think this tweet was all talk, what little coding I do at work does sometimes involve some Rust, and I know plenty of colleagues who practically write little else.
Re: Hold your horses!
The point I was making, with some simple examples, is that Rust does not automatically make your programming less vulnerable. It handles certain things better, and that is good. But it is very wrong to make the over-generalised statement as in the article that "Rust seems less prone to potential memory corruption bugs and this makes software less vulnerable", as though that is the *only* or most important feature making software vulnerable.
I would not want anyone to think "we are programming in Rust so we are secure (or more secure)". That is far too big a jump.
Re: Hold your horses!
But, you are doing the same thing, only in the other direction. The statements in the article about "less vulnerable" are correct, as is your statement that Rust does not make programs fully secure. To me, it seems like you are deliberately trying to downplay the advantages of using safe languages like Rust. The benefits are real - such usage *will* make many (most?) programs less vulnerable. Not completely invulnerable of course, but definitely LESS vulnerable.
There are other types of gotchas in most languages. One that I found a couple days ago in my C code is years old:
wrong: ... 1 << n ...
right: ... 1ull << n ...
(64 bit compilation)
If I recall correctly integral literals in Rust are u32, so the same problem exists there.
Re: Hold your horses!
You have fallen into the trap. You are a good example of what I wrote about people using Rust saying that automatically makes them more secure.
Rust has certain features, but it can not stop you writing insecure programs. Let's say you have the most memory-safe Rust program out there, yet your shoddy programming still has an error - let's say you accept an authentication token that you should not or you allow access from an IP range that you shouldn't because you can't calculate a netmask properly. Congratulations. Your memory safe program will not save you, yet you think you are safe just because you are suing Rust. These are trivial examples that I see today in all sorts of programming "examples", and no doubt I will see them in Rust too.
Replacement versus successor
As the quotes in the article and elsewhere point out, Rust is currently the language of choice for new projects that would have previously been written in C/C++. But migrating an existing system from C/C++ to Rust is difficult. It is a replacement for C/C++, not a successor.
In July at Cpp North, Google announced it is working on Carbon as a successor which will be backward compatible with C/C++ and would make it much better for conversions. But when or even if it emerges from the lab is up in the air.
Addressing some of the comments, rest assured that C and C++ will still be available if you want them. Heck, Fortran and COBOL are still available.
Also rest assured that bad programmers will still be able to write bad code regardless of the language.
bad programmers will still be able to write bad code bad Fortran regardless of the language
FTFY.
This is it.
We could have a language based on the nature tongue of the programmer, where programmers explicitly describe what they want the software to do, and garbage will still be created.
I think a lot of the time (I'm guilty of it, I know others are) people dive in to languages like they're the be all and end all, without ever first considering the structure and shape of the software. Which then means you go and create something, test it, then discover issues. At this point then you're shoehorning fixes in to what you've made to make it work, and for it to pass "tests", and you end up with a mangled mess of software full of sticking plasters and workarounds. Just because you didn't bother to plan what you wrote, you didn't plan better methods of fixing issues you've caused.
Languages aren't the problem. The problem are the programmers.
Not a language, but a website: Stack Overflow
Rust fixed that for you
The PHB has had it with C and C++ because he never could write anything that worked.
Re: Rust fixed that for you
The PHB has had it with C and C++ because he never could write anything that compiled.
FTFY
OK
"Rust, designed by as a hobby by Graydon Hoare"
He must really know how to party -- making a vaguely C-like language but with a compiler that gives errors if you do memory-unsafe or thread-unsafe activities? I mean, I'm a programmer and nerdy and I still find this to be a rather dull hobby 8-)
Anyway.. I really don't think this is a bad idea. I prefer Python but for the types of programming that should be done in C, Rust is fairly C-like but with a ridiculously pedantic compiler that errors out if you write memory-unsafe or thread-unsafe code (there is an "unsafe" keyword, if you have to do some action to talk to existing hardware/software that Rust doesn't like... or if you simply want to do something Rust deems unsafe that you are sure is safe...) It does have facilities for linking with existing C/C++/etc. code too. I'm not a huge fan of Rust any more than I am of C/C++, but I could see Rust being a viable C/C++ replacement in the long term.
Thanks but no thanks.
I'll stick to C when unavoidable, C++ where needed and scripting languages everywhere else.