Slashdot: The Rust Foundation is Reviewing and Improving Rust's Security

The Rust Foundation is Reviewing and Improving Rust's Security
Published on September 15, 2024 at 03:32AM
The Rust foundation is making "considerable progress" on a complete security audit of the Rust ecosystem, according to the coding news site I Programmer, citing a newly-released report from the nonprofit Rust foundation: The foundation is investigating the development of a Public Key Infrastructure (PKI) model for the Rust language, including the design and implementation for a PKI CA and a resilient Quorum model for the project to implement, and the report says that language updates suggested by members of the Project were nearly ready for implementation. Following the XZ backdoor vulnerability, the Security Initiative has focused on supply chain security, including work on provenance-tracking, verifying that a given crate is actually associated with the repository it claims to be. The top 5,000 crates by download count have been checked and verified. Threat modeling has now been completed on the Crates ecosystem. Rust Infrastructure, crates.io and the Rust Project. Two open source security tools, Painter and Typomania, have been developed and released. Painter can be used to build a graph database of dependencies and invocations between all crates within the crates.io ecosystem, including the ability to obtain 'unsafe' statistics, better call graph pruning, and FFI boundary mapping. Typomania ports typogard to Rust, and can be used to detect potential typosquatting as a reusable library that can be adapted to any registry. They've also tightened admin privileges for Rust's package registry, according to the article. And "In addition to the work on the Security Initiative, the Foundation has also been working on improving interoperability between Rust and C++, supported by a $1 million contribution from Google." According to the Rust foundation's technology director, they've made "impressive technical strides and developed new strategies to reinforce the safety, security, and longevity of the Rust programming language." And the director says the new report "paints a clear picture of the impact of our technical projects like the Security Initiative, Safety-Critical Rust Consortium, infrastructure and crates.io support, Interop Initiative, and much more."

Comments

Slashdot: AT&T Says Leaked Data of 70 Million People Is Not From Its Systems

AT&T Says Leaked Data of 70 Million People Is Not From Its Systems Published on March 20, 2024 at 02:15AM An anonymous reader quotes a report from BleepingComputer: AT&T says a massive trove of data impacting 71 million people did not originate from its systems after a hacker leaked it on a cybercrime forum and claimed it was stolen in a 2021 breach of the company. While BleepingComputer has not been able to confirm the legitimacy of all the data in the database, we have confirmed some of the entries are accurate, including those whose data is not publicly accessible for scraping. The data is from an alleged 2021 AT&T data breach that a threat actor known as ShinyHunters attempted to sell on the RaidForums data theft forum for a starting price of $200,000 and incremental offers of $30,000. The hacker stated they would sell it immediately for $1 million. AT&T told BleepingComputer then that the data did not originate from them and that its systems were not breached. &q

Slashdot: Texas A&M University Tops Nation in Engineering Research Expenditures

Texas A&M University Tops Nation in Engineering Research Expenditures Published on June 19, 2024 at 12:50AM An anonymous reader shares a report: Texas A&M University held the largest engineering research portfolio of any academic institution in the country last year, nearing half a billion dollars and surpassing Massachusetts Institute of Technology for the top spot, according to U.S. News & World Report. The state flagship's College of Engineering recorded $444.7 million in research expenditures in the 2023 fiscal year, university officials said. A mix of federal, state and private grants funds those efforts, so more expenditures means more partnerships and a larger engineering footprint than ever, Texas A&M University System Chancellor John Sharp said. "An awful lot of people in Washington, a lot of people in Austin, a lot of people in the private sector now rely on Texas A&M to do their engineering research," Sharp said. "Of all the places in

Slashdot: AT&T Can't Hang Up On Landline Phone Customers, California Agency Rules

AT&T Can't Hang Up On Landline Phone Customers, California Agency Rules Published on June 22, 2024 at 01:50AM An anonymous reader quotes a report from Ars Technica: The California Public Utilities Commission (CPUC) yesterday rejected AT&T's request to end its landline phone obligations. The state agency also urged AT&T to upgrade copper facilities to fiber instead of trying to shut down the outdated portions of its network. AT&T asked the state to eliminate its Carrier of Last Resort (COLR) obligation, which requires it to provide landline telephone service to any potential customer in its service territory. A CPUC administrative law judge recommended rejection of the application last month, and the commission voted to dismiss AT&T's application with prejudice on Thursday. "Our vote to dismiss AT&T's application made clear that we will protect customer access to basic telephone service... Our rules were designed to provide that assurance,

Shameless Plug

Search This Blog