Post #1887736

2026-04-24 12:04 UTC

@swick and it's really shameful that supposedly security minded programming language communities (rust...) don't grok that, and happily work with the guaranteed insecure traditinal posix stuff instead of doing things better. I am pretty sure posix fs shenanigans are a bigger attack surface these days to gain privs than frickin memory unsafety, and focussing solely on memory stuff ignoring the fs stuff is just bad security engineering.

Replies (2)

@matk@mastodon.social 2026-04-25 05:13

@pid_eins @swick This!!! It's not just essential for security, but also dramatically increases robustness of the resulting application - I ran into the latter just last week (debugging data loss for a non-security-relevant app). Even though I know about all of this, I still use the POSIX-like interfaces a lot because they're default in many languages and readily available and "it's not security relevant anyway". Until it is. Better defaults would be so nice!

Open ##1887737
@josh@social.joshtriplett.org 2026-04-25 19:44

I wouldn't say "happily". Rust standard library folks are very well aware of the ideal of doing fd-based operations whenever possible, and we'd love to. Linux is doing great work on adding ways to do everything one might want to do using fds. However, we can't force people to run on exclusively modern Linux, as opposed to old Linux or other OSes. And it's much more challenging to design *portable* interfaces around fds without accepting capability limitations or lowest-common-denominator. We could probably make an extremely capable interface, if we stuck most of it in `std::os::linux`, and had some of it fail if run on older Linux.

Open ##1887738