How Rust’s standard library was vulnerable for years and nobody noticed(medium.com)
medium.com
How Rust’s standard library was vulnerable for years and nobody noticed
https://medium.com/@shnatsel/how-rusts-standard-library-was-vulnerable-for-years-and-nobody-noticed-aebf0503c3d6
3 comments
The article touches on this with a quote from the security team:
> - We don’t have the time or inclination to work on updating this policy until after the [2018] edition ships
> — We’d rather take the time to get it right, but don’t have the time right now
> - We don’t have the time or inclination to work on updating this policy until after the [2018] edition ships
> — We’d rather take the time to get it right, but don’t have the time right now
This is a formal verification project that has already found some bugs: http://plv.mpi-sws.org/rustbelt/ Interestingly, it's also found some cases where type bounds were unnecessarily restrictive.
@Rust team - and all other language teams for that matter - what process and tools will formally be used to prevent this from happening?