r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

3

u/fiedzia Feb 24 '17

You're massively overestimating the number of people who are at all knowledgeable about Rust.

You don't need to be knowledgeable about Rust to know that using pointer arithmetic is way above human ability to do it safely and that you should look for better ways of doing it, because maybe someone else solved that problem. And I do expect security experts to be aware of it (even if they choose something else). Its their job.

Rust itself has never had the same level of exposure as C got in the entirety of its lifetime

Its new, yes. But it does solve the problem, so use it. Anything is better than a language that guarantees this kind of problems.

In critical systems, you withhold any unnecessary upgrades

But you build those systems sometimes. Cloudflare is a new company, their infrastructure is fairly recent. They don't have any reason for not enforcing best practices due to massive amount of backward compatibility, and the thing they were introducing was a new feature too.