avatarTeri Radichel

Free AI web copilot to create summaries, insights and extended knowledge, download it at here

5172

Abstract

">Here’s what Wikipedia has to say about it, and if you don’t trust Wikipedia you can verify this against other sources:</p><figure id="d5b5"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*D4qGLhx54XliAbq9P3Ztqg.png"><figcaption></figcaption></figure><div id="8a41" class="link-block"> <a href="https://en.wikipedia.org/wiki/Rust_(programming_language)#"> <div> <div> <h2>Rust (programming language) - Wikipedia</h2> <div><h3>Rust is a multi-paradigm, general-purpose programming language that emphasizes performance, type safety, and…</h3></div> <div><p>en.wikipedia.org</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/)"></div> </div> </div> </a> </div><p id="496a">So as I’m reading the above I notice one name in particular: <i>Huawei</i>. That’s a Chinese company. Chinese companies are subject to Chinese law. I wrote about that here:</p><div id="8931" class="link-block"> <a href="https://readmedium.com/new-chinese-law-limits-vulnerability-reports-da457a7953e8"> <div> <div> <h2>New Chinese Law Limits Vulnerability Reports</h2> <div><h3>Do you know where your security products are tested?</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*ITAx4TckrOit8KVtlrOi6A.png)"></div> </div> </div> </a> </div><p id="987b">Chinese law states that if anyone in China finds a vulnerability in some technology it must first be reported to the Chinese government first and not disclosed to anyone else. That causes me to pause and consider the implications.</p><p id="6710">That doesn’t mean everyone from China is bad — far from it. It just may be a concern because Chinese citizens and companies have to follow Chinese laws. If Chinese citizens or companies are involved in a project, do they have access to vulnerabilities others might not know about?</p><p id="c885">On the other hand, people in China might be more willing to use the language if they are involved in the process and can see for themselves no one is intentionally inserting malware and vulnerabilities for political reasons.</p><p id="3eaa">We can take a closer look and see what the risk might be in this particular case.</p><p id="996a">Take a look at the GitHub repository.</p><div id="50d6" class="link-block"> <a href="https://github.com/rust-lang/rust"> <div> <div> <h2>GitHub - rust-lang/rust: Empowering everyone to build reliable and efficient software.</h2> <div><h3>Empowering everyone to build reliable and efficient software. - GitHub - rust-lang/rust: Empowering everyone to build…</h3></div> <div><p>github.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*rRlJT3166Zi1_7Ce)"></div> </div> </div> </a> </div><p id="6116">Scroll down to Contributors.</p><figure id="f71b"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*DSGuN30T44JBMNwfrHyewg.png"><figcaption></figcaption></figure><p id="2216">Here’s where you can see who is contributing the most to the open source software.</p><figure id="edf7"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*CqbkcuZFJJ2JwOthO__Vvw.png"><figcaption></figcaption></figure><p id="66b3">You can also look at what they are contributing. You can review the code and the issues related to anyone’s contributions.</p><p id="1def">I read something recently about monitoring for people who intentionally submit security flaws to open source software. I wonder what kind of review process rust has and who is in charge of it.</p><p id="3ee5">And no, your software scanner is not going to find every subtle logic error. Scanners can help find things humans miss or don’t have time to review, but in critical components, human review is the most effective and essential. I often have to set my scanners aside on <a href="https://2ndsightlab.com/cloud-penetration-testing.html">penetration tests</a> when they aren’t working properly and reverse engineer what is going on — and almost always come up with a load of vulnerabilities because companies were counting on scanners that weren’t really working.</p><p id="63b9">In other cases, your scanner might be the problem:</p><div id="272d" class="link-block"> <a href="https://www.unqork.com/resources/unqork-and-qualys-partner-to-resolve-zero-day-vulnerabilities"> <div> <div> <h2>Unqork and Qualys Partner to Resolve Zero-Day Vulnerabilities</h2> <div><h3>Unqork takes security seriously, and in accordance with our Vulnerability Disclosure Policy we follow the…</h3></div>

Options

         <div><p>www.unqork.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/)"></div>
          </div>
        </div>
      </a>
    </div><p id="c994">I found this information about the Rust code review process:</p><div id="9bac" class="link-block">
      <a href="https://forge.rust-lang.org/compiler/reviews.html">
        <div>
          <div>
            <h2>Review policies</h2>
            <div><h3>Supplemental documentation for contributing to The Rust Programming Language</h3></div>
            <div><p>forge.rust-lang.org</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/)"></div>
          </div>
        </div>
      </a>
    </div><p id="1250">Well, that sounds ok. Only one reviewer for updates but better than nothing. When people say they have policies that’s great but do they follow them? That’s what audits are for. Is anyone auditing the Rust review process?</p><p id="98c0">Well, when you have open source software supported by “the community” who is going to pay for that audit?</p><p id="0d6b">We can learn something about Rust funding and operations here in the annual report (and you can find prior annual reports by changing the year in the link: <a href="https://foundation.rust-lang.org/static/publications/annual-reports/annual-report-2023.pdf">https://foundation.rust-lang.org/static/publications/annual-reports/annual-report-2023.pdf</a>)</p><p id="c47e">The good thing is that Rust has support from many major high tech companies, not just one big one for the primary funding (like the Cloud Native Foundation which is primarily funded by Google.)</p><figure id="04f2"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*rbvDHErSPfQMjG-CNxtpnw.png"><figcaption></figcaption></figure><p id="9c3d">I like this section on security very much:</p><figure id="9f7e"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*Sn7ROfB0AQ9izis5_aamiA.png"><figcaption></figcaption></figure><p id="ec01">Aha — here’s something about security auditing. This sounds promising.</p><figure id="ca05"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*6Q6Wpc0j66THYfCUy9NSvQ.png"><figcaption></figcaption></figure><p id="9b1e">Well, nothing is foolproof and that’s not a ton of detail, but one thing I like is that there are multiple companies involved with divergent interests that will hopefully balance each other out and keep things transparent.</p><p id="a5f1">Also, if I start using the software I can take a closer look at it myself and see what I can find. 😊</p><p id="a2f8">Update —a couple days after I wrote this post, Google announced a new grant for the Rust Foundation:</p><div id="b4e9" class="link-block">
      <a href="https://www.theregister.com/2024/02/05/google_rust_donation/">
        <div>
          <div>
            <h2>Google throws $1M at Rust Foundation to build C++ bridges</h2>
            <div><h3>Chocolate Factory matches Microsoft money for memory safety</h3></div>
            <div><p>www.theregister.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*qTT4Mezyvl9ErSkB)"></div>
          </div>
        </div>
      </a>
    </div><p id="980a">Interesting!</p><p id="ece6">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2024</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="3b5e"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="5610"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

Evaluating Use of a New Programming Language ~ Rust

ACM.450 Is it safe to use an open source language not supported directly by a vendor?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Part of my series on Automating Cybersecurity Metrics. The Code.

🔒 Related Stories: AWS Security | Application Security

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In the last post I was writing about ideas for importing resources into CloudFormation.

Along the way I’ve been considering which “real” programming language I might use going forward to implement all of what I’ve been building. I was interested in golang because it has some built in safety mechanisms but hear more and more about Rust so looking into that as well.

Whenever I use a new product, service, programming language, or anything else in technology I look at two things first and foremost. I look at who created it and who maintains it.

I’ve written about this before in relation to supply chain attacks and added a variation of this information to the lab content when I updated the SANS material for a cloud security class I used to teach (originally written by Dave Shackleford, fellow IANS faculty member now.)

Before I use any open source software, I look at who wrote the software and who maintains it.

If you look at the GitHub repository for any open source software you can see who created it, who owns it, and who is actively contributing to the software. I also like to review the process for updating and reviewing the software and think about potential long term risks if things change.

I was recently considering whether I wanted to migrate some of what I am doing to Rust.

So of course the first thing I did was look at who created it.

In 2006, the software developer, Graydon Hoare, started Rust as a personal project while he was working at Mozilla.

It’s an interesting story and seems to be fine as far as I am concerned. Rust was created as a side project by someone working at Mozilla who later went to work on Swift at Apple. He is no longer involved in the project.

Who supports the software now? Well, Mozilla continued to support the software after he left until 2020. During the covid epidemic they laid off most of the Rust staff. So unfortunate.

Then, a foundation was created to support Rust.

Here’s what Wikipedia has to say about it, and if you don’t trust Wikipedia you can verify this against other sources:

So as I’m reading the above I notice one name in particular: Huawei. That’s a Chinese company. Chinese companies are subject to Chinese law. I wrote about that here:

Chinese law states that if anyone in China finds a vulnerability in some technology it must first be reported to the Chinese government first and not disclosed to anyone else. That causes me to pause and consider the implications.

That doesn’t mean everyone from China is bad — far from it. It just may be a concern because Chinese citizens and companies have to follow Chinese laws. If Chinese citizens or companies are involved in a project, do they have access to vulnerabilities others might not know about?

On the other hand, people in China might be more willing to use the language if they are involved in the process and can see for themselves no one is intentionally inserting malware and vulnerabilities for political reasons.

We can take a closer look and see what the risk might be in this particular case.

Take a look at the GitHub repository.

Scroll down to Contributors.

Here’s where you can see who is contributing the most to the open source software.

You can also look at what they are contributing. You can review the code and the issues related to anyone’s contributions.

I read something recently about monitoring for people who intentionally submit security flaws to open source software. I wonder what kind of review process rust has and who is in charge of it.

And no, your software scanner is not going to find every subtle logic error. Scanners can help find things humans miss or don’t have time to review, but in critical components, human review is the most effective and essential. I often have to set my scanners aside on penetration tests when they aren’t working properly and reverse engineer what is going on — and almost always come up with a load of vulnerabilities because companies were counting on scanners that weren’t really working.

In other cases, your scanner might be the problem:

I found this information about the Rust code review process:

Well, that sounds ok. Only one reviewer for updates but better than nothing. When people say they have policies that’s great but do they follow them? That’s what audits are for. Is anyone auditing the Rust review process?

Well, when you have open source software supported by “the community” who is going to pay for that audit?

We can learn something about Rust funding and operations here in the annual report (and you can find prior annual reports by changing the year in the link: https://foundation.rust-lang.org/static/publications/annual-reports/annual-report-2023.pdf)

The good thing is that Rust has support from many major high tech companies, not just one big one for the primary funding (like the Cloud Native Foundation which is primarily funded by Google.)

I like this section on security very much:

Aha — here’s something about security auditing. This sounds promising.

Well, nothing is foolproof and that’s not a ton of detail, but one thing I like is that there are multiple companies involved with divergent interests that will hopefully balance each other out and keep things transparent.

Also, if I start using the software I can take a closer look at it myself and see what I can find. 😊

Update —a couple days after I wrote this post, Google announced a new grant for the Rust Foundation:

Interesting!

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2024

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab
Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation
Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
Open Source
Software
Code
Rust
Programming
Recommended from ReadMedium