User avatar
lcamtuf verified verified verified @lcamtuf@infosec.exchange
2mo
The coreutils Rust rewrite story is pretty funny.

Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

seclists.org/oss-sec/2026/q2/332

PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.
❤️1
27
3
1
1
User avatar
Xerz ๐Ÿ’— @xerz@masfloss.net
2mo
@lcamtuf ........ouch

I'm shocked they didn't account for any of that
1
0
0
0
User avatar
fungus (penicillin producer) @hypha@cafe.mycelium.locahlo.st
2mo
@xerz @lcamtuf itโ€™s easy to fall for domain specific knowledge traps when youโ€™re learning
which is why itโ€™s often advised against rewriting software from scratch, especially if you were not in the first team of developers
1
0
0
0
User avatar
Celeste_transbian flori_ava_star:~cursor_blinkingbadge-petting-encouraged badge-biting-allowed @star@amazonawaws.com
2mo
@hypha @xerz @lcamtuf tbf i think the framing that "they shouldn't have" is wrong and bad. *canonical* should not have switched, because that is such a bad idea
1
0
9
0
User avatar
Xerz ๐Ÿ’— @xerz@masfloss.net
2mo
@star @hypha @lcamtuf yeah, the audits should have come first, not the other way around

all they did was give them free patches, so uh... yet another Rust advantage?
baaโ€‹
1
0
0
0
User avatar
LisPi @lispi314@udongein.xyz
2mo
@xerz @star @hypha @lcamtuf Switching to dependencies with a single non-replaceable toolchain is also irresponsible.

Core utilities should not rely on something that can believably be slopped into oblivion with no viable replacement (C compilers are a dime a dozen and comparatively much easier to implement, with many functional replacements readily available).

Proper specification of all the core toolchains should be a bare minimum.
1
0
1
0
User avatar
Xerz ๐Ÿ’— @xerz@masfloss.net
2mo
@lispi314 @hypha @star @lcamtuf in fairness GNU has a viable alternative, gccrs is aiming for Rust 1.49 and is getting quite close rust-gcc.github.io/2026/04/13/2026-03-monthly-report.html

.....not sure what compiler version
uutils requires tho
1
0
0
0
User avatar
LisPi @lispi314@udongein.xyz
2mo
@xerz @hypha @star @lcamtuf Last I had heard from gccrust is that it couldn't even be used for bootstrap compiling yet, without enforcing any of the semantics a Rust compiler is expected to.

It's unclear whether it also now does that as of this progress report or not. If it does then that would be progress indeed.
2
0
0
0
User avatar
Celeste_transbian flori_ava_star:~cursor_blinkingbadge-petting-encouraged badge-biting-allowed @star@amazonawaws.com
2mo
@lispi314 @xerz @hypha @lcamtuf you don't need borrow checking in well-formed programs. You need borrow checking to ensure a program is safe. the rust compiler is currently the definition of what is well-formed so you don't really have an advantage if you compile the 1.49 sources with or without borrow checking
0
0
0
0