Hacker News Reader

Is it a replacement for freeipa? Key cloak?

Yes, it's a replacement for both - still in (a rapidly developing) Alpha stage currently.

So far LDAP and PAM/NSS modules are fully operational, and OAuth's being tested.

Looks like it squarely competes with FreeIPA. Maybe main differentiator is that FreIPA is in python whereas this is in rust (and so less prone to bugs)?

Is it a widely held concept that Rust is less prone to bugs compared to Python? I've only heard it being compared to C, and only wrt. memory safety bugs.

Rust is statically typed and doesn't have null returns, so it's got advantages for correctness, but the big win with Rust vs. Python would be performance, not security.

There's a lot more checks and balances built into rust as a language, so the foot-gun opportunities are less likely - which makes it rather suitable for reliable systems programming.

And getting back to this particular case... kanidm is fast AND reliable. There's a lot of testing going on comparing it to 389 DS.

Yes, I write a fair bit of Rust. I'm just saying: between Python and Rust, there isn't that much of a security difference (you could nitpick things like deserialization in Python, but really the significant security win of Rust is not having memory corruption flaws, which Python has never really had.)

Reply on news.ycombinator.com