Should you prefer the Rust language to C and C++ in your future projects? In any case, this is the opinion of Mark Russinovich, Chief Technology Officer of Microsoft Azure, for whom developers should avoid using C or C++ programming languages in new projects and use Rust instead due to security concerns. and reliability.
Rust is now used in the Android Open Source Project (AOSP), at Meta, at Amazon Web Services, at Microsoft for parts of Windows and Azure, in the Linux kernel, and in many other places. This language born on the side of Mozilla is appreciated today for its “memory safety guarantees”, which reduce the need to manually manage the memory of a program and, therefore, the risk of security vulnerabilities related to the memory burdens on large projects written in “memory insecure” C or C++, which includes Chrome, Android, Linux kernel, and Windows.
Microsoft made that point in 2019 after revealing that 70% of its patches over the past 12 years were memory safety bug fixes, largely because Windows is written primarily in C and C++. Google’s Chrome team came up with their own findings in 2020, revealing that 70% of all serious security bugs in Chrome’s code base were memory management and security bugs. The code is mainly written in C++.
A perfect successor to C and C++?
Azure’s CTO’s only reservation about using Rust is that it’s better than C and C+ for new projects that require a non-GC (non-garbage-collected) language. GC engines handle memory management. Go, Google’s language, is a garbage collection language, while the Rust project claims the opposite. AWS engineers prefer Rust over Go because of the efficiencies it offers without GC.
“Speaking of languages, it’s time to stop starting any new project in C/C++ and use Rust for scenarios where a non-GC language is needed. For security and reliability reasons, the industry should declare these languages deprecated”, indicates the leader. For the latter, Rust is a promising successor to C and C++, especially for systems-level programming, infrastructure projects, embedded software development, and more — but not everywhere and not in all projects.
As a reminder, Meta recently promoted Rust as the main supported server-side language, alongside C++. AWS invests in Rust for infrastructure software. Azure engineers used it to build cloud tools for testing WebAssembly modules in Kubernetes. On the other hand, the Chrome team is tied to C++ for the foreseeable future, despite the interest in Rust; simply switching to Rust would not eliminate a significant proportion of security vulnerabilities for years, Google says. Instead, Chrome brings memory safety to its C++ codebase.
Source: ZDNet.com