@pinskia I started out cautiously optimistic about Rust. Between the Palantir nazi situation and the embrace of vibecoded RIIR shit, I am so done with Rust. Something being written in Rust is an immediate "do not want". I hope eventually the GCC Rust frontend will make it possible to use the occasional Rust stuff I might need for something, but I really hate it.
0 Boosts
1 Like
@cr1901 @pinskia The cargo ecosystem (hundreds of random untrustworthy deps in everything) is an orders-of-magnitude-worse security problem than lack of memory-safety.
Especially when the vast majority of programs are not attack surface where lack of memory-safety matters. While *all programs* are backdoor-surface.
Even if the program I want to run does not do anything with untrusted data files or accessing a network, I can get popped just by building/installing it if one of the countless shit transitive-deps off cargo got popped.
@dalias @pinskia I don't think I'm qualified to have an opinion on your post. My above post, reworded to be less nice but still reflect what I've seen is:
There's a 'if you don't use a memory safety language when you can, nothing else matters. Your code is not legitimate, and I will not consider using it or helping you' attitude. You may be very well right it's a bigger problem. But the 'memory-safe-or-illegitimate' peers will definitely have their stats ready (70% of all bugs, etc).
@dalias @pinskia Putting aside my personal thoughts: it's true that Rust prevents bug classes by saying "no, you can't do that" at compile time. And in theory, can be used anywhere C can. Most ppl will not willingly go back to managing avoid those bug classes manually (and, as we've seen, imperfectly) when Rust's portability is "good enough*". It's a hard sell for ppl who don't have specific priorities.
* Not reflective of my opinion.