16
lcamtuf :verified: :verified: :verified: (@lcamtuf@infosec.exchange)
infosec.exchangeThe coreutils Rust rewrite story is pretty funny.
Coreutils are tools like rm, mv, mkdir, etc. Unlike binutils, this isn't a fertile ground for memory safety bugs. But, the rewrite was completed, and in the spirit of progress, Canonical decided to switch.
But do you know what coreutils are a fertile ground for? Race conditions around file creation, deletion, permission setting, and so on. The original code accounted for decades of hard-learned lessons in that space. The Rust rewrite did not:
https://seclists.org/oss-sec/2026/q2/332
PS. I'm not dunking on Rust. It's just that... starting over from scratch has its hidden costs.


The real underlying issue here is that the OS interfaces these programs rely on are extremely error-prone and difficult to use correctly. A naive implementation of these system utilities in any language is basically guaranteed to stumble into bugs and vulnerabilities like the ones described in the linked message.