<![CDATA[The coreutils Rust rewrite story is pretty funny.]]>The coreutils Rust rewrite story is pretty funny.

Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.

But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:

https://seclists.org/oss-sec/2026/q2/332

PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.

]]>https://forum.fedi.dk/topic/39603a67-2480-4f67-8b6b-c471dda162f1/the-coreutils-rust-rewrite-story-is-pretty-funny.RSS for NodeThu, 14 May 2026 05:56:47 GMTMon, 04 May 2026 16:14:48 GMT60<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 04:11:39 GMT]]>@groxx @lcamtuf 30 years is a long time, especially for institutions which don’t know their planning horizon is that long, which is most of them

]]>https://forum.fedi.dk/post/https://tilde.zone/users/fivetonsflax/statuses/116520012995964641https://forum.fedi.dk/post/https://tilde.zone/users/fivetonsflax/statuses/116520012995964641Tue, 05 May 2026 04:11:39 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 03:52:03 GMT]]>@Slash909uk @lcamtuf

Previously

https://mastodon.social/@jerrej/116515031377013873

]]>https://forum.fedi.dk/post/https://mastodon.social/users/jerrej/statuses/116519935884627935https://forum.fedi.dk/post/https://mastodon.social/users/jerrej/statuses/116519935884627935Tue, 05 May 2026 03:52:03 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 02:46:27 GMT]]>@Doomed_Daniel @ireneista @r Firefox is still lumbering toward full enablement of JPEG XL as far as I know; they landed a Rust-written decoder to replace the C++ reference decoder, and I think they're making sure it gets to feature parity before they'll push it and close the tracking bug

]]>https://forum.fedi.dk/post/https://snoot.tube/users/Skirmisher/statuses/116519677935428858https://forum.fedi.dk/post/https://snoot.tube/users/Skirmisher/statuses/116519677935428858Tue, 05 May 2026 02:46:27 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 02:45:30 GMT]]>@ShadSterling @Orb2069 @lcamtuf a very common refrain during these rust rewrites is that the RiiR side is finding and documenting all of the undocumented and forgotten edge cases that the original source code has but nobody understands why.

Occasional mistakes are expected along that kind of path. But the end result is often much better understood.

]]>https://forum.fedi.dk/post/https://hachyderm.io/users/groxx/statuses/116519674240429367https://forum.fedi.dk/post/https://hachyderm.io/users/groxx/statuses/116519674240429367Tue, 05 May 2026 02:45:30 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 02:30:02 GMT]]>@Seirdy@pleroma.envs.net @ireneista@adhd.irenes.space @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @puppygirlhornypost2

Thank you! I'll give it a whirl later!

]]>https://forum.fedi.dk/post/https://transfem.social/notes/alvkrmqom9id02lhhttps://forum.fedi.dk/post/https://transfem.social/notes/alvkrmqom9id02lhTue, 05 May 2026 02:30:02 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 02:15:36 GMT]]>@Equity7804 @lcamtuf There are plenty of potential memory safety issues, but also about 30 years of people fixing those issues. The difficulty is that is another category of issues, filesystem races, that Rust does not help you with at all, but that also had about 30 years of fixing in GNU coreutils. The result of ignoring these issues was that the Rust coreutils as they stand today are much more insecure than GNU coreutils.

]]>https://forum.fedi.dk/post/https://sfba.social/users/not2b/statuses/116519556623943552https://forum.fedi.dk/post/https://sfba.social/users/not2b/statuses/116519556623943552Tue, 05 May 2026 02:15:36 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 02:14:27 GMT]]>@yon @lcamtuf agreed. I've been building, solving and shipping for decades, repeatedly. I've fixed Heinsenbugs in legacy systems that had millions of dollars of biz revenue flowing through it. My code runs as part of our collective infrastructure. I prob know a bit about which I speak. 😉 And I can usually spot fools, wannabes or grifters. Fundamentals never change, thankfully.

]]>https://forum.fedi.dk/post/https://social.vivaldi.net/users/synlogic4242/statuses/116519552135382822https://forum.fedi.dk/post/https://social.vivaldi.net/users/synlogic4242/statuses/116519552135382822Tue, 05 May 2026 02:14:27 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 02:11:35 GMT]]>@lcamtuf As someone who spent more than 30 years writing C++ professionally, I don't object to efforts to rewrite that stuff in a safer language, and I like Rust, but Canonical was extremely premature in their decision to make the rewritten coreutils the default. As the article makes clear, they completely ignored race condition issues, and I'm wondering if management didn't understand that Rust's ability to prevent data races does not carry over to filesystem races. With this huge volume of CVEs it seems that their testing efforts must have been woefully inadequate. I suppose one way to go is to just ship it and let the Internet test it for them.

]]>https://forum.fedi.dk/post/https://sfba.social/users/not2b/statuses/116519540825708583https://forum.fedi.dk/post/https://sfba.social/users/not2b/statuses/116519540825708583Tue, 05 May 2026 02:11:35 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 02:07:29 GMT]]>@2something@transfem.social @Doomed_Daniel@mastodon.gamedev.place @ireneista@irenes.space @lcamtuf@infosec.exchange @puppygirlhornypost2@transfem.social it’s packaged by almost every distro and easy to statically link and take with you

]]>https://forum.fedi.dk/post/https://pleroma.envs.net/objects/96669d24-7762-4abe-9c60-945c5f541a09https://forum.fedi.dk/post/https://pleroma.envs.net/objects/96669d24-7762-4abe-9c60-945c5f541a09Tue, 05 May 2026 02:07:29 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 02:05:22 GMT]]>@2something@transfem.social @Doomed_Daniel@mastodon.gamedev.place @ireneista@irenes.space @lcamtuf@infosec.exchange @puppygirlhornypost2@transfem.social it’s not full pcre with stuff like variable length lookbehinds but it’s close enough with named capture groups and the like. It uses Rust’s regex crate

]]>https://forum.fedi.dk/post/https://pleroma.envs.net/objects/b05ab819-fcb9-421a-956c-d4d32778d2f6https://forum.fedi.dk/post/https://pleroma.envs.net/objects/b05ab819-fcb9-421a-956c-d4d32778d2f6Tue, 05 May 2026 02:05:22 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 02:04:53 GMT]]>@synlogic4242 @lcamtuf I’ve learnt to differentiate between people who only talk about the tech, and never about solving problems. It’s been the same for decades.

Tech can be fun, not saying it shouldn’t be. But it doesn’t create solutions by itself.

]]>https://forum.fedi.dk/post/https://sakurajima.moe/users/yon/statuses/116519514482193507https://forum.fedi.dk/post/https://sakurajima.moe/users/yon/statuses/116519514482193507Tue, 05 May 2026 02:04:53 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 02:01:37 GMT]]>@2something@transfem.social @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@irenes.space @puppygirlhornypost2@transfem.social no thats something else. it’s one of those newer rust utilities like what ripgrep is for grep.

https://github.com/chmln/sd

]]>https://forum.fedi.dk/post/https://pleroma.envs.net/objects/32ecedee-52ca-4e3f-80fb-07cc68679f57https://forum.fedi.dk/post/https://pleroma.envs.net/objects/32ecedee-52ca-4e3f-80fb-07cc68679f57Tue, 05 May 2026 02:01:37 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 01:55:34 GMT]]>@Seirdy@pleroma.envs.net @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@adhd.irenes.space @puppygirlhornypost2

I just ran man sd and I don't understand anything of what it said.

]]>https://forum.fedi.dk/post/https://transfem.social/notes/alvjjapld88z09tohttps://forum.fedi.dk/post/https://transfem.social/notes/alvjjapld88z09toTue, 05 May 2026 01:55:34 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 01:54:39 GMT]]>@wolf480pl @sten @ChuckMcManis @lcamtuf most serious race condition in production is the race to push to prod before you bounce on a Friday afternoon

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/darkuncle/statuses/116519474264749821https://forum.fedi.dk/post/https://infosec.exchange/users/darkuncle/statuses/116519474264749821Tue, 05 May 2026 01:54:39 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 01:54:18 GMT]]>@2something@transfem.social @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @ireneista@irenes.space @puppygirlhornypost2@transfem.social the sd utility is excellent for this <img class=“not-responsive emoji” src=“https://pleroma.envs.net/emoji/custom/colon_three.png” title=“:colon_three:” />

]]>https://forum.fedi.dk/post/https://pleroma.envs.net/objects/ffd4b65f-9b05-4e62-b73b-c01f625f6962https://forum.fedi.dk/post/https://pleroma.envs.net/objects/ffd4b65f-9b05-4e62-b73b-c01f625f6962Tue, 05 May 2026 01:54:18 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 01:53:34 GMT]]>@ChuckMcManis @josh @lcamtuf incentives trump everything

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/darkuncle/statuses/116519470028213980https://forum.fedi.dk/post/https://infosec.exchange/users/darkuncle/statuses/116519470028213980Tue, 05 May 2026 01:53:34 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 01:53:17 GMT]]>@Seirdy@pleroma.envs.net @ireneista@adhd.irenes.space @lcamtuf@infosec.exchange @Doomed_Daniel@mastodon.gamedev.place @puppygirlhornypost2

I have personally found it mildly irritating that
a) GNU Grep has PCRE as an option but Gnu Sed does not, and
b) Sometimes I can figure out how to do something in PCRE but not whatever version of regex GNU sed uses.

I can get around this mild irritation by using perl or python directly instead of sed.

]]>https://forum.fedi.dk/post/https://transfem.social/notes/alvjgd6xm9id02khhttps://forum.fedi.dk/post/https://transfem.social/notes/alvjgd6xm9id02khTue, 05 May 2026 01:53:17 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 01:44:39 GMT]]>@Doomed_Daniel @r @q @erincandescent @pinskia @lcamtuf ah thanks

]]>https://forum.fedi.dk/post/https://adhd.irenes.space/users/ireneista/statuses/01KQTWY2FN0CTT1C2WZFXSE8CThttps://forum.fedi.dk/post/https://adhd.irenes.space/users/ireneista/statuses/01KQTWY2FN0CTT1C2WZFXSE8CTTue, 05 May 2026 01:44:39 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 01:40:35 GMT]]>@ireneista @r @q @erincandescent @pinskia @lcamtuf
yeah, but disabled by default in chromium and AFAIK in Firefox it's only in the nightlies

https://en.wikipedia.org/wiki/JPEG_XL?useskin=vector#Web_browsers

]]>https://forum.fedi.dk/post/https://mastodon.gamedev.place/users/Doomed_Daniel/statuses/116519418949137672https://forum.fedi.dk/post/https://mastodon.gamedev.place/users/Doomed_Daniel/statuses/116519418949137672Tue, 05 May 2026 01:40:35 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 01:05:01 GMT]]>@pinskia @ireneista @lcamtuf
> It is also why Microsoft Edge went from something written from scratch to be a fork of chromium

Wasn't that because most of Edge audience heavily used Google products (including Google maps and YouTube and Google meet), and Google actively sabotaged the performance of these products in Edge specifically, in order to push users away from it and towards Chrome?

]]>https://forum.fedi.dk/post/https://embracing.space/users/IngaLovinde/statuses/116519279097550694https://forum.fedi.dk/post/https://embracing.space/users/IngaLovinde/statuses/116519279097550694Tue, 05 May 2026 01:05:01 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 00:55:37 GMT]]>@lcamtuf yeah. currently running Ubuntu 24.04 LTS. My next upgrade will be a different distribution I think😥

BSD maybe?

]]>https://forum.fedi.dk/post/https://mastodon.me.uk/users/Slash909uk/statuses/116519242139208989https://forum.fedi.dk/post/https://mastodon.me.uk/users/Slash909uk/statuses/116519242139208989Tue, 05 May 2026 00:55:37 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 00:53:18 GMT]]>@Slash909uk @cmdrmoto @benh @lcamtuf especially in the age of AI

]]>https://forum.fedi.dk/post/https://hachyderm.io/users/dolanor/statuses/116519232998252100https://forum.fedi.dk/post/https://hachyderm.io/users/dolanor/statuses/116519232998252100Tue, 05 May 2026 00:53:18 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 00:37:39 GMT]]>@cmdrmoto @benh @lcamtuf wow, I had not re-read that for years! This highlight is the killer insight for me:

'It’s harder to read code than to write it.'

So much lost and relearned (or not☹️) for this simple reason!

]]>https://forum.fedi.dk/post/https://mastodon.me.uk/users/Slash909uk/statuses/116519171472922763https://forum.fedi.dk/post/https://mastodon.me.uk/users/Slash909uk/statuses/116519171472922763Tue, 05 May 2026 00:37:39 GMT<![CDATA[Reply to The coreutils Rust rewrite story is pretty funny. on Tue, 05 May 2026 00:37:05 GMT]]>@Doomed_Daniel @r @q @erincandescent @pinskia @lcamtuf when it was removed. it came back?

]]>https://forum.fedi.dk/post/https://adhd.irenes.space/users/ireneista/statuses/01KQTS2B2WCEQBFQVN7AJ8WA9Chttps://forum.fedi.dk/post/https://adhd.irenes.space/users/ireneista/statuses/01KQTS2B2WCEQBFQVN7AJ8WA9CTue, 05 May 2026 00:37:05 GMT