Mark Russinovich, the chief technology office (CTO) of Microsoft Azure, says developers should avoid using C or C++ programming languages in new projects and instead use Rust because of security and reliability concerns.
Rust, which hit version 1.0 in 2020 and was born at Mozilla, is now being used within the Android Open Source Project (AOSP), at Meta, at Amazon Web Services, at Microsoft for parts of Windows and Azure, in the Linux kernel, and in many other places.
Engineers value its “memory safety guarantees”, which reduce the need to manually manage a program’s memory and, in turn, cut the risk of memory-related security flaws burdening big projects written in “memory unsafe” C or C++, which includes Chrome, Android, the Linux kernel, and Windows.
Also: The most popular programming languages and where to learn them
Microsoft drove home this point in 2019 after revealing 70% of its patches in the past 12 years were fixes for memory safety bugs due largely to Windows being written mostly in C and C++. Google’s Chrome team weighed in with its own findings in 2020, revealing that 70% of all serious security bugs in the Chrome codebase were memory management and safety bugs. It’s written mostly in C++.
“Unless something odd happens, it [Rust] will make it into 6.1,” wrote Torvalds, seemingly ending a long-running debate over Rust becoming a second language to C for the Linux kernel.
The Azure CTO’s only qualifier about using Rust is that it was preferable over C and C+ for new projects that require a non-garbage-collected (GC) language. GC engines handle memory management. Google’s Go is a garbage-collection language, while the Rust project promotes that Rust is not. AWS engineers like Rust over Go because of the efficiencies it offers without GC.
“Speaking of languages, it’s time to halt starting any new projects in C/C++ and use Rust for those scenarios where a non-GC language is required. For the sake of security and reliability. the industry should declare those languages as deprecated,” Russinovich wrote.
Rust is a promising replacement for C and C++, particularly for systems-level programming, infrastructure projects, embedded software development, and more – but not everywhere and not in all projects.
Indeed, Russinovich added later: “There is an enormous amount of C/C++ that will be maintained and evolve for decades (or longer). Last night I coded a feature for Handle, adding to the roughly 85,000 lines of Sysinternals C/C++ code I’ve written. That said, I’ll bias towards Rust for new tools.”
Rust is cerrtainly moving forwards and is likley to be in the Linux kernel soon.
The AOSP, which is a Linux distribution, started using Rust on new code in April 2021 but left its C/C++ code base in place. That month, AOSP also backed calls for Rust as an option for new code in the Linux kernel.
Also: How to run websites as apps with ease in Linux
Meta recently promoted Rust as a primary supported server-side language alongside C++. AWS invests in Rust for infrastructure software. Azure engineers have used it to build cloud tools for testing WebAssembly modules in Kubernetes. On the other side, the Chrome team is tied to C++ for the foreseeable future, despite interest in Rust; simply switching to Rust wouldn’t eliminate a significant proportion of security vulnerabilities for years, they said. Instead, Chrome is bringing memory safety to its C++ code base.
Also, Rust shouldn’t be viewed as a silver bullet for all the bad habits developers practice when coding in C or C++.
Bob Rudis, a cybersecurity researcher for GreyNoise Intelligence, who was formerly with Rapid7, noted developers can carry across the same bad security habits to Rust.
“Given what it takes (time/money/people/services) to make “real” C/C++ projects safe-r at any speed, I tend to agree [with Russinovich]. Having said that, it’s possible to bring the same bad practices to Rust,” he wrote.
ZDNet’s Steven J. Vaughan-Nichols broadly agreed with that sentiment:
“As others have said, you can write “safely” in C or C++, but it’s much harder, no matter what dialect you use than it is in Rust. Mind you, you can still foul up security in Rust, but it does avoid a lot of old memory problems.”
