Find an error on the Rust runtime and then the whole security collapses down as a house of cards.
It's bad to think on security by just using a language.
It's bad to think on security by just using a language.
Nobody is suggesting that a language solves all security issues.
It does have much better memory safety than C, which is the cause of the majority of security issues.
(0) https://prev.rust-lang.org/en-US/faq.html#does-rust-have-a-r...
"Rust is blazingly fast and memory-efficient: with no runtime or garbage collector" [0]
I guess it depends on what you mean by a runtime. Panic handlers and initialisation code is a pretty small runtime.
It's funny how rust is praised as secure without any code audit.
https://github.com/RustSec/rustsec/tree/main/cargo-audit
https://mozilla.github.io/cargo-vet/
Besides, every dependency is locked.
Rust improves or eliminates some issues, but that does not imply that other issues are magically solved.
My c compiler does not connect to internet during compiling.
Do you not have to install said dependency from the Internet and start (at least part of) the compile over?
Rust's build system, Cargo, does however. And many C build systems do as well, e.g. https://cmake.org/cmake/help/latest/guide/using-dependencies...
ifconfig eth0 down
before compiling to avoid such issues.
Wouldn't it be the static or dynamic linked libraries for the particular program in question?
There is a crt.0 "C Runtime" object. This is code that is literally run "at runtime". When you execute a binary, the C runtime is the first thing executed to setup the stack and call main().
This is just a bit of assembly that runs before main(). It shares ~nothing in common with "runtime" languages like Python or Java where the runtime is alive during the whole program's execution.
The C run time does not handle floats or threads or anything like that. Software floats are dealt with by the compiler and threading is implemented as its own library (either in userspace or built into the kernel).
https://learn.microsoft.com/en-us/cpp/c-runtime-library/c-ru...
It doesn't matter what people think, rather the CS point of view of a language runtime is.
That library is the runtime.
C implementation without the respective runtime is what is called a freestanding implementation as per ISO C.
This was a good name at the time. Its a bit of code that gets executed literally "at runtime". When you run a program, this object gets invoked to setup the stack and call main(). Its just a bit of assembly.
Then, decades later, languages like Java overloaded the term "runtime" to refer to their interpreter / vm. This causes confusion to this day, evidently.