<div dir="ltr">Rust seems like the best available choice for Tor in a safer language.<br><br>Rust has several issues with securely obtaining a Rust toolchain that the Tor community should be attentive to.<br><br>Rust is a self hosted compiler. Building Rust requires obtaining binaries for a recent Rust compiler. The Rust toolchain is vulnerable to a "trusting trust" attack. Manish made a prototype and discussed future mitigations.[0]<br><br>The Rust toolchain is built by an automated continuous integration system and distributed without human verification or intervention. Rust's build artifacts distributed by the RustUp tool are only authenticated by TLS certificates. RustUp Github issue 241 discusses a mitigation to address some of these concerns but development seems to be stalled.[1]<br><br><br>[0] <a href="https://manishearth.github.io/blog/2016/12/02/reflections-on-rusting-trust/">https://manishearth.github.io/blog/2016/12/02/reflections-on-rusting-trust/</a><br>[1] <a href="https://github.com/rust-lang-nursery/rustup.rs/issues/241">https://github.com/rust-lang-nursery/rustup.rs/issues/241</a><br><br><br></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Mar 31, 2017 at 2:23 PM Sebastian Hahn <<a href="mailto:sebastian@torproject.org">sebastian@torproject.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi there tor-dev,<br class="gmail_msg">
<br class="gmail_msg">
as an update to those who didn't have the chance to meet with us in<br class="gmail_msg">
Amsterdam or those who haven't followed the efforts to rely on C less,<br class="gmail_msg">
here's what happened at the "let's not fight about Go versus Rust, but<br class="gmail_msg">
talk about how to migrate Tor to a safer language" session and what<br class="gmail_msg">
happened after.<br class="gmail_msg">
<br class="gmail_msg">
Notes from session:<br class="gmail_msg">
<br class="gmail_msg">
We didn't fight about Rust or Go or modern C++. Instead, we focused on<br class="gmail_msg">
identifying goals for migrating Tor to a memory-safe language, and how<br class="gmail_msg">
to get there. With that frame of reference, Rust emerged as a extremely<br class="gmail_msg">
strong candidate for the incremental improvement style that we<br class="gmail_msg">
considered necessary. We were strongly advised to not use cgo, by people<br class="gmail_msg">
who have used it extensively.<br class="gmail_msg">
<br class="gmail_msg">
As there are clearly a lot of unknowns with this endeavor, and a lot<br class="gmail_msg">
that we will learn/come up against along the way, we feel that Rust is a<br class="gmail_msg">
compelling option to start with, with the caveat that we will first<br class="gmail_msg">
experiment, learn from the experience, and then build on what we learn.<br class="gmail_msg">
<br class="gmail_msg">
You can also check out the session notes on the wiki (submitted, but not<br class="gmail_msg">
posted yet).[1]<br class="gmail_msg">
<br class="gmail_msg">
The real fun part started after the session. We got together to actually<br class="gmail_msg">
make a plan for an experiment and to give Rust a serious chance. We<br class="gmail_msg">
quickly got a few trivial things working like statically linking Rust<br class="gmail_msg">
into Tor, integrating with the build system to call out to cargo for the<br class="gmail_msg">
Rust build, and using Tor's allocator from Rust.<br class="gmail_msg">
<br class="gmail_msg">
We're planning to write up a blog post summarizing our experiences so<br class="gmail_msg">
far while hopefully poking the Rust developers to prioritize the missing<br class="gmail_msg">
features so we can stop using nightly Rust soon (~months, instead of<br class="gmail_msg">
years).<br class="gmail_msg">
<br class="gmail_msg">
We want to have a patch merged into tor soon so you can all play with<br class="gmail_msg">
your dev setup to help identify any challenges. We want to stress that<br class="gmail_msg">
this is an optional experiment for now, we would love feedback but<br class="gmail_msg">
nobody is paid to work on this and nobody is expected to spend more<br class="gmail_msg">
time than they have sitting around.<br class="gmail_msg">
<br class="gmail_msg">
We have committed to reviewing any patch that includes any Rust code to<br class="gmail_msg">
provide feedback, get experience to develop a style, and actually make<br class="gmail_msg">
use of this experiment. This means we're not ready to take on big<br class="gmail_msg">
patches that add lots of tricky stuff quite now, we want to take it slow<br class="gmail_msg">
and learn from this.<br class="gmail_msg">
<br class="gmail_msg">
We would like to do a session at the next dev meeting to give updates on<br class="gmail_msg">
this effort, but in the meantime, if team members would like to start<br class="gmail_msg">
learning Rust and helping us identify/implement small and well-isolated<br class="gmail_msg">
areas to begin migration, or new pieces of functionality that we can<br class="gmail_msg">
build immediately in Rust, that would be really great.<br class="gmail_msg">
<br class="gmail_msg">
So, for a TLDR:<br class="gmail_msg">
<br class="gmail_msg">
What has already been done:<br class="gmail_msg">
- Rust in Tor build<br class="gmail_msg">
- Putting together environment setup instructions and a (very small)<br class="gmail_msg">
initial draft for coding standards<br class="gmail_msg">
- Initial work to identify good candidates for migration (not tightly<br class="gmail_msg">
interdependent)<br class="gmail_msg">
<br class="gmail_msg">
What we think are next steps:<br class="gmail_msg">
- Define conventions for the API boundary between Rust and C<br class="gmail_msg">
- Add a non-trivial Rust API and deploy with a flag to optionally use<br class="gmail_msg">
(to test support with a safe fallback)<br class="gmail_msg">
- Learn from similar projects<br class="gmail_msg">
- Add automated tooling for Rust, such as linting and testing<br class="gmail_msg">
<br class="gmail_msg">
<br class="gmail_msg">
Cheers<br class="gmail_msg">
Alex, Chelsea, Sebastian<br class="gmail_msg">
<br class="gmail_msg">
[1]: Will be visible here <a href="https://trac.torproject.org/projects/tor/wiki/org/meetings/2017Amsterdam/Notes" rel="noreferrer" class="gmail_msg" target="_blank">https://trac.torproject.org/projects/tor/wiki/org/meetings/2017Amsterdam/Notes</a><br class="gmail_msg">
_______________________________________________<br class="gmail_msg">
tor-dev mailing list<br class="gmail_msg">
<a href="mailto:tor-dev@lists.torproject.org" class="gmail_msg" target="_blank">tor-dev@lists.torproject.org</a><br class="gmail_msg">
<a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev" rel="noreferrer" class="gmail_msg" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev</a><br class="gmail_msg">
</blockquote></div>