Yet another day, yet another vulnerability in center C code. This one happened because of two distinct conditions using the identical sentinel value:
- On Unix, a password hash of "*" has meant a locked document since the extremely first days.
- Since 2012, musl libc’s crypt function has returned the cord "*" for a password that’s too lengthy for it to hash.
The two points combined, alongside alongside sshd hashing login attempts for locked accounts to evade timing leaks, average that on musl systems without PAM (like, oh, the authoritative Alpine AWS image), an unauthenticated person now gets a (possibly root) casing on your computer.
This is not a recollection safety vulnerability; rather, it is one of those issues that, group frequently say, languages alongside improved category systems won’t preserve you from. This is true! You can extremely fine compose a Rust function that returns "*" if the password is too long. But the big difference between C and Rust in this regard is that the norms of the Rust community do not authorize that.
The POSIX spec tries to document for error cases. It says:
Upon prosperous completion, crypt() shall come back a pointer to the hashed password; […] Otherwise, it shall come back a null pointer and set errno to signify the error.
But the C category scheme can’t power developers to inspect that the come back value is NULL. The musl libc developers saw that several binaries weren’t checking for it, and hence deviated from the spec, returning the sentinel "*" value instead.
As I’ve written concerning before, category systems have a powerful consequence on engineering culture. Because C doesn’t have algebraic data types or outcome types, the engineering norms that form about C communities guide to this benevolent of in-band signaling. Meanwhile, in Rust, a password that’s too lengthy would be returned as an error variant, and the visitant would be compelled to grip it. What if there isn’t an error type today? Then a breaking alter would add an error variant, and a RustSec advisory would likely be published as well.
As an aside, it remains amazing to me whenever Linux distro maintainers objection concerning projects introducing Rust dependencies. Rather than adapting to the new earth anywhere the engineering norms are apt to assist users better, these maintainers importune on the earth adapting to them. Yes, compile times and portability to niche architectures are genuine costs, but are you current to assist your own interests or the bulk of your users’? There’s a genuine principal-agent problem going on here.
Agents won’t preserve you#
Speaking of agents! There’s a latest strain of disagreement that goes approximately akin this:
- Rust is admittedly helpful for humans to compose accurate application today.
- LLMs can now, or in the near forthcoming volition be capable to, logic concerning recollection safety and another error cases directly.
- So in an agent-heavy betterment lifecycle there’s no difference in application rigor between Rust and C (or equal assembly).
- But C has certain advantages complete Rust in conditions of build speed, portability, etc.
- So we power as fine compose application in C (or equal assembly).
There is plentifulness that’s incorrect concerning the argument, including the dubious decision to rely a fuzzy procedure whenever we have already shown that a far additional deterministic method works. But the big missing part is the norms of the corresponding communities! When you (or your agent) compose Rust software, you’re likely going to use Rust libraries, and your delegate is likely going to pattern-match on existing Rust code in its training set. As a result, even if you aren’t already a skilled Rust developer, there volition apt be additional invariants encoded in the category system1.
The engineering norms of C developers authorize for "*" to be an satisfactory sentinel value indicating an error; the engineering norms of Rust developers merely do not. These norms are the outcome of the accumulated contributions of a community, and part of the duty of a application expert is to think concerning the kinds of communities one’s activity is a part of. But several group have decided that none of this really matters in this shiny new world, and that the contributions of another group can mostly be ignored. Their hubris volition be their downfall.
Discuss on Hacker News.
