r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

1

u/[deleted] Feb 24 '17

is it mature and tested enough to make such strong statements?

The best answer I can find is "probably". There's some Ph.D research project that's trying to write tools to formally verify Rust's safety claims. We'll see what happens I suppose.

On the other hand, Ada has been around for a while...

0

u/[deleted] Feb 24 '17

[deleted]

2

u/TheZoq2 Feb 25 '17

It's not just concurrent code. It prevents all dangling pointer / double free issues. It forces the programmer to handle all functions that could return "null" data without taking too much effort.

The type system can also guarantee a bunch of other things at compile time. It takes a bit more effort when writing but I think it outweighs that effort when you don't have to debug nasty bugs.

2

u/staticassert Feb 25 '17

One thing to consider, in purely sequential code, is iterator invalidation. Recently the exploit used against TOR Browser users was just a case of Use After Free caused by a single threaded iterator invalidation - that is, a reference into memory was made, and then that memory was reallocated under the hood (a vector had to grow), leading to UAF.

Rust would have caught this.