Hacker News Reader

Comment by redox99 | Hacker News Reader

Rust and go don't have a C backbone like PHP does. So they are inherently safer to these kinds of vulnerabilities.

Garbage collection is also an option. Lots of backends on the JVM!

(Of course there's Log4shell, but that could've happened to a Rust-based stack too, and might be more likely to, considering the proliferation of deeply-nested dependency trees full of tiny libraries in that ecosystem.)

Log4Shell wouldn't have happened in Rust because no widely used Rust serialization library is designed to call arbitrary code at deserialization time.

My point is that large Rust projects end up using hundreds of transitive dependencies that indirectly touch user input, and certainly some of them have vulnerabilities (memory safety isn't the only vulnerability class - it's just low-hanging fruit for LLMs), and any could become malicious.

Log4Shell wasn't a supply chain attack, though; it was a genuine bug in a widely used library that had become a de facto standard, even in an ecosystem that tends towards relatively smaller and shallower dependency trees. So that comparison doesn't seem apt.

it's a good point. I wonder if we'll see a PHP fork and rewrite in rust. like tcrs. given the recently issues they would seem to benefit the most...

There are plenty of alternative interpreters or compilers out there already, no need to start a new one again: https://github.com/gakowalski/alternative-interpreters#alter...

Reply on news.ycombinator.com