Oops

Another potential option here is https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html

ip_unprivileged_port_start - INTEGER

    This is a per-namespace sysctl. It defines the first unprivileged port in the network namespace. Privileged ports require root or CAP_NET_BIND_SERVICE in order to bind to them. To disable all privileged ports, set this to 0. They must not overlap with the ip_local_port_range.

    Default: 1024

This is also per namespace so you could use it in combination with network namespaces if you really wanted to keep privileged ports.

TIL I didn’t realize Java used UTF16 for its internal representation. Looks like it’s a bit more complicated than that after Java 9 too

Android defaults to UTF16

In some build modes clang will simply put a trap where it sees undefined behavior. https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html

Not saying your wrong, just a fun fact I guess

This is a real exploit chain in cups-browsed. The tl;dr is that it will add basically anything that knows the correct protocol to your list of available printers, and this can be exploited for RCE if you print to the malicious printer. The service listens on all interfaces by default on UDP 631.

It is not as horrible as it was marketed, but it’s real and not great. You may or may not have this service running by default; I didn’t on Fedora.

His full write-up is here: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

Redox also takes some inspiration from Plan9 and https://doc.redox-os.org/book/ch05-00-schemes-resources.html is interesting. Also reading https://drewdevault.com/2022/11/12/In-praise-of-Plan-9.html made me a bit more interested in things trying to be more Plan9-like than Unix-like.

This doesn’t seem to be a Rust problem, but a modern development trend appearing in a Rust tool shipped with Cargo. The issue appears to be the way things are versioned and (reading between the lines maybe?) vendoring and/or lockfiles. Lockfiles exist in a lot of modern languages and package managers: Go has go.sum, Rust has Cargo which has Cargo.lock, Python has pip which gives a few different ways to pin versions, JavaScript has npm and yarn with lock files. I’m sure there are tons of others. I’m actually surprised this doesn’t happen all the time with newer projects. Maybe it does actually and this instance just gains traction because people get to say “look Rust bad Debian doesn’t like it”.

This seems like a big issue if you want your code to be packaged by Debian, and it doesn’t seem easy to resolve if you also want to use the modern packaging tools. I’m not actually sure how they resolve this? There are real benefits to pinning versions, but there are also real benefits to Debian’s model (of controlling all the dependencies themselves, to some extent Debian is a lockfile implemented on the OS level). Seems like a tough problem and seems like it’ll end up with a lot of newer tools just not being available in Debian (by that I mean just not packaged by Debian, they’ll likely all run fine on Debian).

I agree and think that should be helpful, but I hesitate to say how much easier that actually makes writing sound unsafe code. I’d think most experienced C developers also implicitly know when they’re doing unsafe things, with or without an unsafe block in the language – although I think the explicit unsafe should likely help code reviewers and tired developers.

It is possible to write highly unsafe code in Rust while each individual unsafe block appears sound. As a simple example: https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=6a1428d9cae5b9343b464709573648b4 [1] Run that on Debug and Release builds. Notice the output is different? Don’t take that example as some sort of difficult case, you wouldn’t write this code, but the concepts in it are a bit worrisome. That code is a silly example, but each individual unsafe block appears sound when trying to reason only within the block. There is unsafe behavior happening outside of the unsafe blocks (the do_some_things function should raise eyebrows), and the function we ultimately end up in has no idea something unsafe has happened.

Unsafe code in Rust is not easy, and to some extent it breaks abstractions (maybe pointers in general break abstractions to some extent?). noaliases in that playground code rightly assumes you can’t have a &ref and &mut ref to the same thing, that’s undefined behavior in Rust. Yet to understand the cause of that bug you have to look at all function calls on the way, just as you would have to in C, and one of the biggest issues in the code exists outside of an unsafe block.

[1]: If you don’t want to click that link or it breaks, here is the code:

fn uhoh() {
    let val = 9;
    let val_ptr: *const usize = &val;
    do_some_things(val_ptr);
    println!("{}", val);
}

fn do_some_things(val: *const usize) {
    let valref = unsafe { val.as_ref().unwrap() };
    let mut_ptr: *mut usize = val as *mut usize;
    do_some_other_things(mut_ptr, valref);
}

fn do_some_other_things(val: *mut usize, normalref: &usize) {
    let mutref = unsafe { val.as_mut().unwrap() };
    noaliases(normalref, mutref);
}

fn noaliases(input: &usize, output: &mut usize) {
    if *input < 10 {
        *output = 15;
    }
    if *input > 10 {
        *output = 5;
    }
}

fn main() {
    uhoh();
}

No intention of validating that behavior, it’s uncalled for and childish, but I think there is another bit of “nontechnical nonsense” on the opposite side of this silly religious war: the RIIR crowd. Longstanding C projects (sometimes even projects written in dynamic languages…?) get people that know very little about the project, or at least have never contributed, asking for it to be rewritten or refactored in Rust, and that’s likely just as tiring as the defensive C people when you want to include Rust in the kernel.

People need to chill out on both sides of this weird religious war. A programming language is just a tool: its merits in a given situation should be discussed logically.

They’re being downvoted because it’s a silly comment that is basically unrelated and also extremely unhelpful. Everyone can agree that C has footguns and isn’t memory safe, but writing a kernel isn’t memory safe. A kernel written in Rust will have tons of unsafe, just look at Redox: https://github.com/search?q=repo%3Aredox-os%2Fkernel unsafe&type=code That doesn’t mean it isn’t safer, even in kernel space, but the issues with introducing Rust into the kernel, which is already written in C and a massive project, are more nuanced than “C bad”. The religious “C bad” and “C good” arguments are kinda exactly the issue on display in the OP.

I say this as someone who writes mostly Rust instead of C and is in favor of Rust in the kernel.

The vast majority wouldn’t be able to be pulled into the kernel since they rely on the existence of the kernel via syscalls.

This is not true at all. https://en.wikipedia.org/wiki/Post-quantum_cryptography good place to start if you’re genuinely interested. Most password managers that are worth while will be using symmetric cryptography which just requires longer key lengths to survive in the quantum age. AES256 should be fine for the foreseeable future.

Replying to this pretentious comment for the sake of others reading this:

Run history | grep genpasswd for why this is not a good password storage solution. One must image skill issue.

If you think the CLI is the cool kid way to go, use https://www.passwordstore.org/, but tbh I don’t recommend that either.

You can use ~/.local/lib and LD_LIBRARY_PATH for shared libs.

Or better yet just give in and use the nix package manager, it is basically a virtual environment for your C programs.

Yes for example Python implements them using semaphores.

It doesn’t violate any rules… Imagine both the “speaker” and the “text” are being updated by separate threads. A program that would eventually display the behavior in this meme is simple, and I’m a bit embarrassed to have written it because of this comment:

#include <pthread.h>
#include <stdio.h>

char* speakers[] = {
    "Alice",
    "Bob"
};
int speaker = 0;

void* change_speaker(void* arg)
{
    (void)arg;

    for (;;) {
        speaker = speaker == 0 ? 1 : 0;
    }
}

char* texts[] = {
    "Hi Bob",
    "Hi Alice, what's up?",
    "Not much Bob",
};
int text = 0;

void* change_text(void* arg)
{
    (void)arg;
    for (;;) {
        switch (text) {
        case 0:
            text = 1;
            break;
        case 1:
            text = 2;
            break;
        case 2:
            text = 0;
            break;
        }
    }
}

int main(int argc, char* argv[])
{
    pthread_t speaker_swapper, text_swapper;

    pthread_create(&text_swapper, NULL, change_text, NULL);
    pthread_create(&speaker_swapper, NULL, change_speaker, NULL);
    for (int i = 0; i < 3; ++i) {
        printf("%s: %s\n", speakers[speaker], texts[text]);
    }
}

Yes I’m mostly familiar with this in Kotlin. Sometimes this is kinda a footgun because you’re writing multi threaded code without explicitly doing so.

Async features in almost all popular languages are a single thread running an event loop (Go being an exception there I believe). Multi threading is still quite difficult to get right if the task isn’t trivially parallelizable.

You can use udev to make a symlink with a consistent name