yorickpeterse

De Reddit experts weten het natuurlijk beter dan de nerds van het UMC...

Looking at the repository after having finished watching the talk, it seems all data is now available. The exploits found thus far were....pretty bad I think.

What I find a little scary is how two people whom by their own claims were still new to the exploiting scene (at least if I understood the talk correctly) were able to find so many issues so quickly. Of course part of the reason is that compared to e.g. Linux there are fewer eyes on FreeBSD, but it does leave a bit of a sour aftertaste so to speak.

Be nice to each other. Flame wars and rants are not welcomed. **Please also put some effort into your post, this isn't Quora. **

Yeah no sorry, this is just a regular boring Quora/shower thought style post that we've had plenty of in the past. More specifically, there's nothing in the post about any specific language choices or what not that may be interesting to discuss. The subreddit is not the place for these kind of discussions.

When did I say anything about concurrency? Also, this is just moving the goal post/whataboutism which isn't exactly productive.

Furthermore, if you'd actually read the report you would've noticed that the issue here was (deliberate) incorrect usage of synchronization primitives. One could argue that something better than mutexes needs to exist and I agree, but using them incorrectly is not an inherent flaw of Rust or any other language exposing them, nor is it an indication that "Rust is unsafe".

Or to put it differently: you seem to dislike Rust and that's fine, but it's just your opinion (and a poorly worded one at that), not a fact.

Following this same logic, all C code should be removed from FreeBSD, and so should pretty much all packages.

CVEs will occur regardless of the language or cleverness of the developers. The difference lies in how easy it is to write problematic code (from a security point of view), i.e the number of footguns per line of code. This is where Rust undeniably does better than almost any other languages, with maybe an exception for Ada+Spark.