Eskil Steenberg – I've had it with the security orthodoxy. – BSC 2025 [video](youtube.com)
youtube.com
Eskil Steenberg – I've had it with the security orthodoxy. – BSC 2025 [video]
https://www.youtube.com/watch?v=SbeNRICgzTA
8 comments
Points made in the rant part:
* Security bugs are not more interesting than other bugs. * Lol, why do people even care about security when they upload everything into the cloud. * Stop crying and start fixing bugs. * Security measures are unreasonable, they prevent development progress and consume too much runtime. * Common negative impression of the C memory model is skewed by surviorship bias. * Many weak links in the chain.
This whole rant is uninformed & it seems like the author is completely ignorant of anything happening outside his well.
But I'll bite the Rust rant anyway.
> Where's your SSL?
Right here: https://www.memorysafety.org/blog/rustls-server-perf/
It's an order of magnitude faster than OpenSSL, and almost double the speed of BoringSSL.
> Where's your operating system?
There are lots of OSes written in Rust, but nobody expects them to replace a well-established piece of software like Linux (and _even Linux_ is integrating Rust, because you can't RIIR the kernel overnight). That's why it's shining in the embedded sector, with stuff such as Tock: https://github.com/tock/tock, or many, many other OSes available today. Oxide Computers uses Rust, Volvo writes a lot of their systems in Rust. I also know a few unnamed MIC companies in Turkey using Rust for their software. Anduril also uses Rust.
Rust also runs the Internet, Cloudflare is primarily Rust and AWS is one of the biggest users of Rust. So many more examples but these are the biggest.
Half my environment is Rust: Helix/Zed my editors, my version control system (jj), my shell (nushell), my Window Manager (niri), the build system I'm working on in Rust to build it all, Firefox which is partially Rust, and I actually enjoy using these greatly, because they're fast, well designed and secure.
Has the author written anything in his life that's not games or toys?
But I'll bite the Rust rant anyway.
> Where's your SSL?
Right here: https://www.memorysafety.org/blog/rustls-server-perf/
It's an order of magnitude faster than OpenSSL, and almost double the speed of BoringSSL.
> Where's your operating system?
There are lots of OSes written in Rust, but nobody expects them to replace a well-established piece of software like Linux (and _even Linux_ is integrating Rust, because you can't RIIR the kernel overnight). That's why it's shining in the embedded sector, with stuff such as Tock: https://github.com/tock/tock, or many, many other OSes available today. Oxide Computers uses Rust, Volvo writes a lot of their systems in Rust. I also know a few unnamed MIC companies in Turkey using Rust for their software. Anduril also uses Rust.
Rust also runs the Internet, Cloudflare is primarily Rust and AWS is one of the biggest users of Rust. So many more examples but these are the biggest.
Half my environment is Rust: Helix/Zed my editors, my version control system (jj), my shell (nushell), my Window Manager (niri), the build system I'm working on in Rust to build it all, Firefox which is partially Rust, and I actually enjoy using these greatly, because they're fast, well designed and secure.
Has the author written anything in his life that's not games or toys?
Eskil is part of ISO working group 14 (C standard) so he's exposed to quite a bit more than you'd think. This isn't some rando ranting about his latest midnight research project, he has enough field experience that the ignorance strawman can't dismiss his observations by itself.
Besides, most of what he talks about here isn't related to language choice anyways.
ps: Hocam hani bize onemli gelebilirde rastgele insanlarin Turkiye'deki anonim sirketlerin ne kullandigini sikledini hic zannetmiyorum.
ps: Hocam hani bize onemli gelebilirde rastgele insanlarin Turkiye'deki anonim sirketlerin ne kullandigini sikledini hic zannetmiyorum.
Not to mention him saying no one writes java anymore when it literally powers world's most popular OS (android) and double digit percentage of internet backends
Isn't android's actual core in C? I thought java was just the ui...
core (as in kernel) is running linux kernel which is C, yes.
But java is not 'just UI' - majority of user space apps run java (or jvm, to be precise), as well as tons of system services, to the point where you can't actually do a lot of android API calls from native code, because a lot of logic is written in java(or kotlin) code, and not just java being wrapper around native code.
But java is not 'just UI' - majority of user space apps run java (or jvm, to be precise), as well as tons of system services, to the point where you can't actually do a lot of android API calls from native code, because a lot of logic is written in java(or kotlin) code, and not just java being wrapper around native code.
> This whole rant is uninformed & it seems like the author is completely ignorant of anything happening outside his well.
Average HN poster.
I watched the video and everything he said I've heard here too.
Average HN poster.
I watched the video and everything he said I've heard here too.
[deleted]