snaggen

joined 1 year ago
 

Abstract—New contributors are critical to open source projects. Without them, the project will eventually atrophy and become inactive, or its experienced contributors will bias the future directions the project takes. However, new contributors can also bring a greater risk of introducing vulnerable code. For projects that have a need for both secure implementations and a strong, diverse contributor community, this conflict is a pressing issue. One avenue being pursued that could facilitate this goal is rewriting components of C or C++ code in Rust— a language designed to apply to the same domains as C and C++, but with greater safety guarantees. Seeking to answer whether Rust can help keep new contributors from introducing vulnerabilities, and therefore ease the burden on maintainers, we examine the Oxidation project from Mozilla, which has replaced components of the Firefox web browser with equivalents written in Rust. We use the available data from these projects to derive parameters for a novel application of learning curves, which we use to estimate the proportion of commits that introduce vulnerabilities from new contributors in a manner that is directly comparable. We find that despite concerns about ease of use, first-time contributors to Rust projects are about 70 times less likely to introduce vulnerabilities than first-time contributors to C++ projects. We also found that the rate of new contributors increased overall after switching to Rust, implying that this decrease in vulnerabilities from new contributors does not result from a smaller pool of more skilled developers, and that Rust can in fact facilitate new contributors. In the process, we also qualitatively analyze the Rust vulnerabilities in these projects, and measure the efficacy of the common SZZ algorithm for identifying bug-inducing commits from their fixes.

 

Quite some exciting progress since the last progress report! There have been 180 commits since the last progress report.

As of today, rustc_codegen_cranelift is available on nightly! :tada: You can run rustup component add rustc-codegen-cranelift-preview --toolchain nightly to install it and then either CARGO_PROFILE_DEV_CODEGEN_BACKEND=cranelift cargo +nightly build to use it for the current invocation or add

 

TL;DR

We want to improve the reliability and performance of crate downloads.

"Non-canonical downloads" (that use URLs containing hyphens or underscores where the crate published uses the opposite) are blocking these plans.

On 2023-11-20 support for "non-canonical downloads" will be disabled.

cargo users are unaffected.

[–] snaggen@programming.dev 3 points 1 year ago

Well, duplicate communities might also be on purpose, to lessen centralization. I see many that try to migrate away from lemmy.ml, and this community is one of them. I agree that it might be a bit confusing, but it is easily worked around by subscribing to both communities.

[–] snaggen@programming.dev 5 points 1 year ago* (last edited 1 year ago) (2 children)

How is communities undiscoverable? There are services for this https://lemmyverse.net/communities , of course it would be nice to have that more integrated in to Lemmy, but it is still there.

[–] snaggen@programming.dev 12 points 1 year ago (1 children)

The reddit thread is found at: https://www.reddit.com/r/rust/comments/162keij/transitioning_rrust_to_the_threadiverse/

I assume there will be some discussion there, so go and let them know what you think.

[–] snaggen@programming.dev 13 points 1 year ago (1 children)

Until Eric is caught cheating on his girlfriend with Alice....

[–] snaggen@programming.dev 6 points 1 year ago

I'd be happy if all movie posters looked like this from now on. They are brilliant!

[–] snaggen@programming.dev 6 points 1 year ago (3 children)

I think they actually tried to take MS to court, but lost since they had stolen the ideas from Xerox in the first place.

[–] snaggen@programming.dev 1 points 1 year ago

They have fixed this and the code is available now.

[–] snaggen@programming.dev 1 points 1 year ago (2 children)

Weird, a blog post by Collabora about a crate by Collabora, that no longer is availabe? Well, the crate seems to be, but not the code. So, what is going on here?

[–] snaggen@programming.dev 28 points 1 year ago (2 children)

I'm happy to see that the maintainer listened to the users, so we got the best possible outcome.

[–] snaggen@programming.dev 7 points 1 year ago

Also, MS pays computer makers to preinstall Windows.

[–] snaggen@programming.dev 4 points 1 year ago (1 children)

Normally during a project, I tend to restructure the code quite a bit. First when it is small, I do it like you and have everything in one file, then as it grows I start to split out the things in to multiple files/modules. Then as it grows even further, I create subfolders. Try to define parts of the algorithms and break them out to their own modules. Like if you have a scheduling part, then you move that to scheduler.rs. Also, move out special types to types.rs, error types to errors.rs to keep the area with the actual algorithms more clear.

So, that the code feels like a mess as it grows is just a normal thing. And often, it is not worth trying to plan that much ahead since it is very difficult to predict the needs.

But for a REST server I have something like this

src/main.rs
src/types.rs
src/api/v1/mod.rs
src/api/v1/errors.rs
src/api/v2/mod.rs
src/api/v2/errors.rs
src/api/v2/types.rs
src/tests/v1.rs
src/tests/v2.rs

But the before the v2 version of the api, there was just a src/api.rs, src/errors.rs . So, I think the key is to not be afrad to shuffle code around and restructure it as you need. And it will not always be good, but then you just do it again. One of the things with a very strict language like Rust is that you can shuffle it around, and rewrite it without a big risk of adding hidden bugs.

[–] snaggen@programming.dev 2 points 1 year ago (1 children)

The implicit contract is to show an ad for a service, but they are actually violating the contract by attaching other things to the ads. They then use the ads to steal information that they then sell without my consent. So, if anything we are discussing honor amongst thieves.

view more: ‹ prev next ›