Rust Safety Further Reading List

rust-safety-further-reading.md

• Slides from my presentation

• The Rust Programming Language - the official book about all of Rust. This is what I recommend starting with if you want to learn Rust. The chapters most relevant to what I talked about are:

  • Ownership
  • References and Borrowing
  • unsafe

• The Rustonomicon - an official book all about writing unsafe Rust. Great deep dive of why and how to write good unsafe code.

• Fearless Concurrency - an official blog post on how safety makes concurrency easier.

• Memory Leaks are Memory Safe - a blog post written by a core team member on why memory leaks are still possible in Rust and what that implies.

• Ruby, Rust, and Concurrency - a blog post of mine about trying to cause a data race using multiple threads in Rust and seeing that it won't compile.

• Programming Language Safety Score - Safe Rust currently ranks 3rd behind Haskell and F#.

• Related to the case studies:

  • Heartbleed:
    • Heartbleed in Rust and the rebuttal Would Rust have prevented Heartbleed? Another Look
    • How to Prevent the next Heartbleed A very thorough analysis of the spectrum of techniques we could improve on to prevent bugs like Heartbleed. Spoiler: he advocates most strongly for more negative testing!
  • Goto Fail:
    • Apple's SSL/TLS bug about "goto fail"
  • Stagefright:
    • Post announcing Rust in Firefox 48 with reference to stagefright vulnerabilities
    • A demonstration of stagefright-like mistakes with the quote that managing memory is hard and you have to be more careful than the Android Security team to get it right all the time
    • Stagefright: Mission Accomplished? - post about the fix to the initial vulnerability still having problems
    • The firefox bug discussing which library to use for mp4 parsing