Skip to content
  • Kategorien
  • Aktuell
  • Tags
  • Beliebt
  • World
  • Benutzer
  • Gruppen
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Standard: (Kein Skin)
  • Kein Skin
Einklappen

other.li Forum

  1. Übersicht
  2. Uncategorized
  3. The coreutils Rust rewrite story is pretty funny.

The coreutils Rust rewrite story is pretty funny.

Geplant Angeheftet Gesperrt Verschoben Uncategorized
77 Beiträge 51 Kommentatoren 0 Aufrufe
  • Älteste zuerst
  • Neuste zuerst
  • Meiste Stimmen
Antworten
  • In einem neuen Thema antworten
Anmelden zum Antworten
Dieses Thema wurde gelöscht. Nur Nutzer mit entsprechenden Rechten können es sehen.
  • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

    The coreutils Rust rewrite story is pretty funny.

    Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

    But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

    https://seclists.org/oss-sec/2026/q2/332

    PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

    ? Offline
    ? Offline
    Gast
    schrieb zuletzt editiert von
    #14

    @lcamtuf

    Joel spolsky had a great blogpost about exactly this didn't he

    ? 1 Antwort Letzte Antwort
    0
    • ? Gast

      @lcamtuf

      Joel spolsky had a great blogpost about exactly this didn't he

      ? Offline
      ? Offline
      Gast
      schrieb zuletzt editiert von
      #15

      @lcamtuf

      https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/

      ? 1 Antwort Letzte Antwort
      0
      • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

        The coreutils Rust rewrite story is pretty funny.

        Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

        But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

        https://seclists.org/oss-sec/2026/q2/332

        PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

        ? Offline
        ? Offline
        Gast
        schrieb zuletzt editiert von
        #16

        @lcamtuf See this all the time - people storm in trying to change things before trying to understand how the current things work. People who don't learn from what's been done before. Society doesn't progress from efforts like theirs. You only make progress by learning from and building on top of what came before.

        ? ? 2 Antworten Letzte Antwort
        0
        • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

          The coreutils Rust rewrite story is pretty funny.

          Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

          But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

          https://seclists.org/oss-sec/2026/q2/332

          PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

          ? Offline
          ? Offline
          Gast
          schrieb zuletzt editiert von
          #17

          @lcamtuf
          I learned C++ after Modula-2 and before C.
          I learned programming earlier.

          Learning a programming language isn't learning programming (extracting requirements, specification, design, coding, test etc).
          I looked at Rust. C++ certainly has got too complicated since 1987, but I wonder does Rust *only* help with memory safety?
          Main memory safety in general relates to using pointers that are invalid, accessing arrays out of bounds and past the end of strings.
          Partly bad libraries & design.

          ? 1 Antwort Letzte Antwort
          0
          • ? Gast

            @lcamtuf See this all the time - people storm in trying to change things before trying to understand how the current things work. People who don't learn from what's been done before. Society doesn't progress from efforts like theirs. You only make progress by learning from and building on top of what came before.

            ? Offline
            ? Offline
            Gast
            schrieb zuletzt editiert von
            #18

            @hyc @lcamtuf ie. be like LEGO not Death Stars

            ? 1 Antwort Letzte Antwort
            0
            • ? Gast

              @lcamtuf

              Deus forbid if they create a functional specification of how the existing utilities work, before converting / rewriting them in a new language 😟🤦‍♂️

              ? Offline
              ? Offline
              Gast
              schrieb zuletzt editiert von
              #19

              @simonzerafa @lcamtuf Hahahahahah...

              Madness.

              1 Antwort Letzte Antwort
              0
              • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                The coreutils Rust rewrite story is pretty funny.

                Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                https://seclists.org/oss-sec/2026/q2/332

                PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                ? Offline
                ? Offline
                Gast
                schrieb zuletzt editiert von
                #20

                @lcamtuf Yeah, not a good situation - even doing it in "safe C++" or somesuch would have had the same result. Decades of hard-learned lessons should be encoded in decades of well-written unit tests.

                1 Antwort Letzte Antwort
                0
                • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                  The coreutils Rust rewrite story is pretty funny.

                  Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                  But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                  https://seclists.org/oss-sec/2026/q2/332

                  PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                  ? Offline
                  ? Offline
                  Gast
                  schrieb zuletzt editiert von
                  #21

                  @lcamtuf Welp. Got rent for next month covered.

                  1 Antwort Letzte Antwort
                  0
                  • ? Gast

                    @lcamtuf and it's very worth remembering that while the design of rust _does_ prevent many bugs, it's not a get-out-of-bugs-free card. there are many ways to write code wrong, not just memory safety issues!

                    ? Offline
                    ? Offline
                    Gast
                    schrieb zuletzt editiert von
                    #22

                    @pikhq @lcamtuf @drwho we are, as a species, especially creative at finding new ways to write code wrong.

                    1 Antwort Letzte Antwort
                    0
                    • ? Gast

                      @lcamtuf
                      I learned C++ after Modula-2 and before C.
                      I learned programming earlier.

                      Learning a programming language isn't learning programming (extracting requirements, specification, design, coding, test etc).
                      I looked at Rust. C++ certainly has got too complicated since 1987, but I wonder does Rust *only* help with memory safety?
                      Main memory safety in general relates to using pointers that are invalid, accessing arrays out of bounds and past the end of strings.
                      Partly bad libraries & design.

                      ? Offline
                      ? Offline
                      Gast
                      schrieb zuletzt editiert von
                      #23

                      @raymaccarthy
                      well allegedly its types are meant to aid in type driven design and better domain modelling; but i dont know if this is actually seen in practice in better code structure. same could be said of cxx + its classes
                      @lcamtuf

                      ? 1 Antwort Letzte Antwort
                      0
                      • ? Gast

                        @lcamtuf ........ouch

                        I'm shocked they didn't account for any of that

                        ? Offline
                        ? Offline
                        Gast
                        schrieb zuletzt editiert von
                        #24

                        @xerz @lcamtuf it’s easy to fall for domain specific knowledge traps when you’re learning
                        which is why it’s often advised against rewriting software from scratch, especially if you were not in the first team of developers

                        ? 1 Antwort Letzte Antwort
                        0
                        • ? Gast

                          @raymaccarthy
                          well allegedly its types are meant to aid in type driven design and better domain modelling; but i dont know if this is actually seen in practice in better code structure. same could be said of cxx + its classes
                          @lcamtuf

                          ? Offline
                          ? Offline
                          Gast
                          schrieb zuletzt editiert von
                          #25

                          @zardoz03 @lcamtuf
                          Strong types help, but loads of languages had that 40 years ago.

                          1 Antwort Letzte Antwort
                          0
                          • ? Gast

                            @lcamtuf Rustaceans are the problem, not Rust itself. theyre like a lobbing group trying explicitly to boost their future employment demand much more than prioritized on doing the right thing as engineers or for the community. much like the AI VC are "talking up their book" even if its poison for the rest of us

                            ? Offline
                            ? Offline
                            Gast
                            schrieb zuletzt editiert von
                            #26

                            @synlogic4242 Uutils started as someone’s personal project to learn rust, and “write a system utility” is frequently used as a basic exercise for learning. Uutils is doing exactly what it set out to do.

                            It’s not the fault of uutils that Canonical is dumb.

                            @lcamtuf

                            ? 1 Antwort Letzte Antwort
                            0
                            • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                              The coreutils Rust rewrite story is pretty funny.

                              Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                              But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                              https://seclists.org/oss-sec/2026/q2/332

                              PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                              ? Offline
                              ? Offline
                              Gast
                              schrieb zuletzt editiert von
                              #27

                              @lcamtuf There's also that human habit of getting complacent about all bugs when _some_ types of bugs are either impossible or very very hard to make because of language structure and tooling.

                              ? 1 Antwort Letzte Antwort
                              0
                              • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                                The coreutils Rust rewrite story is pretty funny.

                                Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                                But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                                https://seclists.org/oss-sec/2026/q2/332

                                PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                                ? Offline
                                ? Offline
                                Gast
                                schrieb zuletzt editiert von
                                #28

                                @lcamtuf a related observation would probably be: why did important, security-critical edge cases get handled without enough documentation to prevent them from reoccurring?

                                ? 1 Antwort Letzte Antwort
                                0
                                • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                                  The coreutils Rust rewrite story is pretty funny.

                                  Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                                  But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                                  https://seclists.org/oss-sec/2026/q2/332

                                  PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                                  ? Offline
                                  ? Offline
                                  Gast
                                  schrieb zuletzt editiert von
                                  #29

                                  @lcamtuf Why do we keep calling uutils coreutils a rewrite?

                                  1 Antwort Letzte Antwort
                                  0
                                  • ? Gast

                                    @synlogic4242 Uutils started as someone’s personal project to learn rust, and “write a system utility” is frequently used as a basic exercise for learning. Uutils is doing exactly what it set out to do.

                                    It’s not the fault of uutils that Canonical is dumb.

                                    @lcamtuf

                                    ? Offline
                                    ? Offline
                                    Gast
                                    schrieb zuletzt editiert von
                                    #30

                                    @rmq @lcamtuf I view it as both their fault. I'm pissed that after having to deal with Copy.Fail I now have to wipe other people's butts again for them. and I worry this will happen with more frequency as more vibe-coded software spreads around

                                    1 Antwort Letzte Antwort
                                    0
                                    • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                                      The coreutils Rust rewrite story is pretty funny.

                                      Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                                      But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                                      https://seclists.org/oss-sec/2026/q2/332

                                      PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                                      ? Offline
                                      ? Offline
                                      Gast
                                      schrieb zuletzt editiert von
                                      #31

                                      @lcamtuf Hey, would you care to elaborate or point me to resources explaining why the coreutils aren't fertile ground for memory safety issues? It's the first time I heard of this

                                      1 Antwort Letzte Antwort
                                      0
                                      • lcamtuf@infosec.exchangeL lcamtuf@infosec.exchange

                                        The coreutils Rust rewrite story is pretty funny.

                                        Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

                                        But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

                                        https://seclists.org/oss-sec/2026/q2/332

                                        PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

                                        ? Offline
                                        ? Offline
                                        Gast
                                        schrieb zuletzt editiert von
                                        #32

                                        @lcamtuf Not only that, some of the utils were not command line-compatible with their non-Rust counterparts.

                                        Honestly, I don't understand why these utils were rewritten. They didn't need rewriting.

                                        ? ? 2 Antworten Letzte Antwort
                                        0
                                        • ? Gast

                                          @ChuckMcManis @lcamtuf sometimes that's the only way to learn, but it's also often the most effective way to learn

                                          ? Offline
                                          ? Offline
                                          Gast
                                          schrieb zuletzt editiert von
                                          #33

                                          @darkuncle @ChuckMcManis @lcamtuf Sure, but perhaps don't do your learning in production? 🙂

                                          ? ? ? 3 Antworten Letzte Antwort
                                          0
                                          Antworten
                                          • In einem neuen Thema antworten
                                          Anmelden zum Antworten
                                          • Älteste zuerst
                                          • Neuste zuerst
                                          • Meiste Stimmen


                                          • Anmelden

                                          • Anmelden oder registrieren, um zu suchen
                                          • Erster Beitrag
                                            Letzter Beitrag
                                          0
                                          • Kategorien
                                          • Aktuell
                                          • Tags
                                          • Beliebt
                                          • World
                                          • Benutzer
                                          • Gruppen