BoringTun v0.4 Released For CloudFlare's Rust-Based WireGuard

[anarki2]

You are missing a lot of context, it's not just about the language, refer to https://blog.cloudflare.com/boringtu...ireguard-rust/

Still doesn't explain what kind of problem this alternative will solve besides NIH (not invented here).

[anarki2]

It's a well established fact that about 70% of all high- and critical-severity security vulnerabilities are the result of memory unsafety, that would have been avoided had software been written in a memory-safe language. The world's most well funded development team working on Google Chrome have acknowledged that security critical parts of it need to be rewritten in a memory-safe language.

Anyone who still fails to see the value of rewriting in rust are choosing blindness. The only reason the whole industry isn't migrating to memory-safe languages now that it's possible for pretty much every use-case is the sheer amount of work, not the lack of value. Starting to write new security-critical software in an unsafe language today would be reckless negligence.

No, it's the lack of need. Anyone who doesn't know what a static analyzer is shouldn't make comments about related issues. If the only way you can solve an issue is by rewriting it from scratch in a different language, you better not even touch that product, because you're disqualified immediately. You can write horrible code in any language. I prefer competent programmers over fresh shiny languages. It's not that earlier programming languages were inherently horrible, it's just that programmers are getting less and less competent. Peeps doing 12-hour Udemy courses now call themselves "programmers".

The CF guys spent 3 years on this already, and it's still nowhere near feature parity. It's not helping anything, it's just a complete waste of time. All because some clever fella in management has warm feelings for Rust. It's all cyclic, first it was Python, then Go, now Rust is the next big thing. Quick, dump all the C(++) code in existence, because we're too stupid to call free() or check the length of our arrays!

[RahulSundaram]

Still doesn't explain what kind of problem this alternative will solve besides NIH (not invented here).

If you read the article fully, can you summarize it and explain why it doesn't answer your question?

[brad0]

You are missing a lot of context, it's not just about the language, refer to https://blog.cloudflare.com/boringtu...ireguard-rust/

That doesn't change what he said. It's another WireGuard implementation in another language that's less portable just as the other implementation in Go.

[RahulSundaram]

That doesn't change what he said. It's another WireGuard implementation in another language that's less portable just as the other implementation in Go.

It talks about why the Go implementation wasn't suitable for their needs. What other explanation do you really need?

[brad0]

It talks about why the Go implementation wasn't suitable for their needs. What other explanation do you really need?

I'm not the one needing an explanation.

[jntesteves]

I prefer competent programmers over fresh shiny languages. It's not that earlier programming languages were inherently horrible, it's just that programmers are getting less and less competent.

I see, this flood of security vulnerabilities is because they don't make programmers like they used to. I think you're on to something here. Maybe the growing cases of marijuana abuse, homosexuality, and liberal policies could also be behind it. Ah, what I would give to go back to the 20th century, when the world was just better.

[RahulSundaram]

I'm not the one needing an explanation.

In this context, we aren't talking about you specifically or anyone in particular, it was used a fourth person singular impersonal pronoun.

[bug77]

This is incorrect. Unsafe is required for many low level things. In low level programming Unsafe is a requirement for most interfacing with the underlying hardware, for example accessing status register values.

I'm a big fan of Rust and their philosophy but people who tend to do things on the high level only get this odd impression that unsafe is this forbidden niche part of the language mostly just for C FFI. That's just not true.

A fair point. I often forget C is not the only "low-level" thing other languages need access to.
Unsafe is not forbidden (otherwise it would not have been exposed), but it is meant to remain niche. At least as far as generic programs go. If all your code is made up of C API calls and register manipulation, then yes, it would be full of unsafe blocks.

I was also under the impression embedded is not Rust's turf yet, because of Rust including its full runtime in a statically compiled program. Turns out for embedded, you do #![no_std], #![no_main] anyway. Thanks for making me look (but I still await the day Rust will be able to also build its own runtime when building an executable).

[jacob]

I fail to see the point. Simply rewriting in a different language is not a plus on its own. They might as well could've sent patches for the things they want to achieve.

I think the key point is that they wanted a user space implementation. Which language it's written in is just a tangential bit of trivia.