[09:35] schestowitzThis report covers revisions hrev54947-hrev54978 (that was a quiet month in Haiku)
[09:40] -TechrightsBN/#boycottnovell- ( status 404 @ https://sylvestre.ledru.info/blog/2021/03/09/debian-running-on-rust-coreutils">Debian ) [09:40] schestowitzI started contributing to the alternative Coreutils developed in Rust. The project aims at proposing a drop-in replacement of the C-based GNU Coreutils, and I wanted to evaluate if this could be used to run a regular Debian. Similar to what I have done with clang.debian.net a few years ago (rebuilding the Debian archive using clang instead of gcc).
[09:40] schestowitzI expect that most of the readers know what is the Coreutils. It is a set of programs performing simple operations (copy/move file, change permissions/ownership, etc). Even if some commands are from the 70s, they are at the base of Linux, Unix and macOS. While different implementations can be found, they are trying to remain compatible in terms of arguments, options, etc. This implementation of Coreutils [09:40] schestowitz isnt different!
[09:42] -TechrightsBN/#boycottnovell-daniel.haxx.se | half of curls vulnerabilities are C mistakes | daniel.haxx.se [09:42] schestowitzPossibly due to the slightly different question, possibly because Ive categorized one or two vulnerabilities differently, possibly because Im biased as heck, but my count end up at:
[09:42] schestowitz51 out of 98 security vulnerabilities are due to C mistakes
[09:42] schestowitzThats still 52%. (you can inspect my analysis and submit issues/pull-requests against the vuln.pm file) and yes, 51 flaws that couldve been avoided if curl had been written in a memory safe language. This contradicts what Ive said in the past, but I will also show you below that the numbers have changed and I still was right back then!