>https://security-tracker.debian.org/tracker/CVE-2026-115905>https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grjRust sisters, i dont feel so good....
>Who is Impacted:>Automated ingestion microservices, SaaS platforms, and backend workers that extract user-submitted ZIP files.>Enterprise architectures where security verification (AV scanning, extension whitelisting) is decoupled from extraction (e.g. gateway audits Central Directory via CDFH before handing off extraction to streaming extractors).>Containerized workloads where overwriting local configuration files or executable scripts leads to host/container escape and complete service disruption.
>>110179273Rust never claimed to have solved logic bugs.
>>110179273this is just an issue with a specific library tho
Exploits, CVE's & RCE's are just a meme now bro, who the fuck cares lmao.
>>110179273>a library has a security flaw<>>a language has a security flaw
>>110179871No, you don't understand, it doesn't matter, because this thread was never really about real issues or Rust preventing pointer arithmetic issues. It wad always always always about how you lost the game.
>>110179984><>
>>110179871>IF IT HECKIN' COMPILES IT WORKS!!!!!!>n-n-nOOO, WE DIDN'T MEAN IT LIKE THATlol
just give up and rope yourself
>>110180020This post is surprisingly low quality, even for 2026 /g/. Back in my day, trolling warranted some level of effort.
>>110180066Slightly higher-quality than the total lie it's mocking just by virtue of containing a fact Rustroons would rather memoryhole.
>>110179871Logic bugs are 99.99999999999999% of bugs in existence. That's why I always found the language a bit weird in one sense. I understand the benefit, but it's such a small thing compared to what actually causes issues in programs and adds lots of complexity just to leave 99.999% of bugs there anyway lol? For military or something sure.
>>110180102>but it's such a small thingI dunno about that one, chief. Memory safe operations are nice, and I need all the help I can get with concurrency.
>>110180102>Logic bugs are 99.99999999999999% of bugs in existencein high level languages yes. If you are working with java/C#/python you should not switch to rust.Rust is for people who had to use C/C++ for certain reasons such as performance or low level memory access where memory access related bugs make up 70% of their bugs as reported by both google and microsoft.https://www.chromium.org/Home/chromium-security/memory-safety/Rust solves their problems it does nothing for java webdevs.
>>110180102Sometimes I see people say something so uninformed that I wonder how they even have the confidence to talk about it.
>>110180161>webdevslol, 90%+ crabheads and libs is webshit
>>110180102Some people will always think you're dumb, anon. That's just part of life. But opening your mouth just to prove them right is a different matter entirely.
>>110180189>>110180175zogbots?
>>110179273>posting an image that doesn't say what the fuck we're looking at
>>110180199Netanyahu just looked up from the old person remote controller he had installed in Trump just to have me tell you can't blame this retardation on him this time.
>>110180005Fuck you
>>110180102But not of RCE's. Not all inputs allow zips, but all inputs allow inputs.
>>110179984The language comes with practically no standard library and pushes you towards using random shit on cargo, with each explicit dependency seemingly pulling in dozens or hundreds of implicit ones, to a point that might even make Nodetards feel sick. That's like saying cars aren't dangerous because you don't have to drive them on a public road.
>>110180102>we introduced zes namespace extension which should help wez application security. we encourage ze ecosystem to adopt it.
putting retarded OP aside, that rating should be challenged.>service interacts with zip file from unsafe sources>security checks constitutes checking the zip file list only... in two different ways>service blindly extracts files without checking names or locations>service just allows overwriting files>overwritten file locations, or allowed new extracted locations, just allow for new scripts to just runi would still give it "8.1", with charity. that would match the rating of the similar(ish) CVE-2025-62518:https://github.com/advisories/GHSA-j5gw-2vrg-8fgx there too, the applicability of the "attack" in practice was rightfully challenged:https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
>>110182162>this time will be different
>>110180102do you, perhaps, use java?
>>110180102>Logic bugs are 99.99999999999999% of bugs in existenceWhy do "people" in this board just make shit up to support their arguments?>>110185758There are tons of other classes of vulnerabilities in java. Deserialization is the most dangerous one, and is very prevalent
>>110182148>The language comes with practically no standard libraryWrong
>>110185220Your post has been processed by Rust code in order to end up here.
>>110180102>Logic bugs are 99.99999999999999% of bugs in existenceActually, 70% of bugs come from memory safety.
>>110180161>low level memory accessto do low level memory access in rust you need unsafe code blocks lmao
>>110179273Groups hating on Rust are either glowies or crooks looking to keep their memory exploits open, or ivory tower spergs who bask in the glory of their footgun knowledge.
>>110185220brootal
>>110186438a good portion of memory bugs in c are logic bugs because in c you deal manually with memorythe vast majority even, id say. but thats based on subjective experience
>>110179273>deranged C trannies have to jump on any random Rust CVE that gets assignedit's honestly pathetic how gay you people are. I don't even know if you qualify as people.
>>110186825>attacks the persona, not the word, outside of reddit
>>110186839if you think this is worth time mentioning, you aren't a person. you are subhuman at best.also see >>110182248it's bad, but not nearly as realistically bad as it's made out to be.this is like the tar CVE awhile ago as well, where the "bad" even in the worst case place it was used: uv, wasn't as bad as made out to be. at best a smuggling primitive.
>>110185220
>>110186862yeah, but stillc-ultsists've been telling you a complex framework comes with risksand you went>nah, it'll be foinewell, heres the "foine" lmoa
>>110186905ya. it will be fine. this is the best you got? where is the end of the world?tar and zip are both dogshit formats as well where these kinds of desyncs are remotely reasonable.I personally don't know why we still use them. I'm at the point where I think mime with a central archive would cover both with less nonsense.
>>110186916>>where is the end of the world?>t. moving goalposts made of ethically sourced strawc-ultsists've been telling you a complex framework comes with risksyou said it'll be foineits not foinethese things will keep on happening bc bugs and exploits are just a thing with sufficiently complex, and evolving codebaseshistory clearly shows that rust is just another javascript, but severely autistic>>110186886brootal.cloudflare uses rust, so thats somethingamazon also uses rust for its infra, but they use a curated subset of cargoand they didnt even use cargo at all in the beginning bc its full of aids and used needles also full of aids
>>110186964>c-ultsists've been telling you a complex framework comes with risksok, and they were wrong. so now what?
>>110186825>deranged Rust trannies have to jump on any random C CVE that gets assignedFTFYThe "would rust have fixed this" crowd are some of the dumbest and most obnoxious circlejerking turbo wankers to come to come out of the woodwork every time a vulnerability is found.
>>110187004where are the threads, tranny?I don't see them.Linux has nearly 100+ CVEs a day at this point and I don't see any thread mocking them (though there should be).You're a pathetic loser who is losing in real time to Rust and have to cope.
>>110187004is that crab ok
>>110187004>mfw>>110186984>so now what?iunno.some banter then we go back to our regularly scheduled shitposting igi had this idea >>110186750maybe you could add your two cents to the pileim still at the idea stage, all input is welcome
>>110186805Typically in such reports logic errors and memory errors are exclusive. Memory errors are related to memory related UBs and logic errors are about correct code(no UB) that doesn't adhere to some logic constrains(eg if you forgot to check user's permission to access certain resource it's logic error, not memory error).
>>110187569yeah but that classification doesnt tell the full storyan oob read is a memory error but in c, its an error in logic more often than not since you work with alot with raw arrays with no bounds checkinglike in an off by one error leading to out of bound read, or write. logic or memory?so yeah. not mutually exclusive irl.>muh ublearn what ub means, you bore
>>110179273Fake CVE again lmao
>>110180161Correct. Rust is for people who are bad at C/C++.
>>110189154No shit, anon. Know who the crossbow was for? People who were bad at archery. But an army with an army of crossbows limiting factor was wood, not human skill. Case in point, a cook supposedly killed King Richard III with that shit.
>>110187726>yeah but that classification doesnt tell the full storyThat's just what it means. You can disagree on the semantics but it doesn't change the reality that 70% of vulnerabilities come from memory errors which Rust makes rare to nonexistent thanks to explicit lifetimes and borrow checker. This is what we are discussing here, labels are only a convention.
>>110189333imagine believing that
>>110189358Believe what? It's just a fact https://blog.google/security/rust-in-android-move-fast-fix-things/What's your next cope?
>>110189623Literally can't make that shit up. Rust psychosis, everybody.
>>110189644Something isn't logically consistent with your post.Did you mean Rust derangement syndrome or are you coping and seething that there are facts proving what that other anon said? Stop coping.
>>110180161Yeah that's legitimately the reason. I don't like computers as a hobby, I just like what they do for me. All I do is write server applications to do genuinely useful stuff in my daily life so C# and Go stuff is what I use. You still have to check for nil but the shit is just so robust and never panics.I don't know if C++ and the rest is a LARP because I did learn it and become proficient enough to write desktop applications, and the GUI kits like Qt feel like they're from 1991. If hobbyist people were genuinely writing useful programs in C++ every day I feel like there'd be modern GUI kits, not ancient slots and signals QML Qt stuff and, significantly worse, gtk. I suspect there are none because the only people actually using it are employees of companies where they have artist teams employed designing custom GUIs.
>>110189154Everyone is bad at C/C++.
>>110189248I never said Rust is useless. It's better than nothing if you don't have much skill.
>>110189717Case in point.
>>110189717Silence tranny.RUST LOST.>>110189901Talk for yourself.
>>110190079>Talk for yourself.Maybe China was right about the great firewall after all.
>>110189958Can you name a programmer that has enough of these skills to not make mistakes that Rust helps with.Just one notable name with public git repos we can check to see what kinds of bugs he makes.
>>110190981D. Richard Hipp.
I'll just have AI(I mean SI, sorry) patch it in 10 minutes.
>>110190981You mean you can ask AI to check.
>>110190981In practice, all rust code is either ai slop or uses Rc everywhere (directly or indirectly). So it's just as "safe" as smart pointers in C++, or as python or java. So it has 0 advantage over anything. So rust is pointless even for jeets who can't code.
maybe chopping off your penis wasn't a great idea after all
>>110190079Everyone is bad at C/C++, because implicit complexity of the language mixed with large codebases makes writing safe and correct code intractable for any human.The funny consequence being: those who think they're good at it are likely the shittiest C/C++ programmers, creating most of the issues - their confidence comes from ignorance.
>>110192590True, but there's a reason rust code is significantly buggier on average: rustfags think the magic borrow checker (that they deliberately bypass all the time) is going to magically fix logic bugs.
>>110192149CVE-2026-50812: A NULL pointer dereference CVE-2026-11822 / CVE-2026-11824: Memory corruption and heap buffer overflowCVE-2025-29088: An incorrect memory allocationCVE-2024-0232: A heap use-after-freeIt seems even he is bad at C/C++.>>110192478>you just need to not be bad C/C++>ie just use AISasuga cniles.>>110192514I have been using rust for nearly 10 years now. We only got good AI like year ago. So obviously most of my code couldn't possibly be made by AI.My programs use Rc seldomly too. Overusing Rc is a sign of inexperienced Rust developer. Git gud.
>>110192949>fake ai-slopped hallucinated "CVEs"Really makes you think
>>110192952We didn't even have AIs that could detect things like that in 2024And this doesn't started there. SQLite just like every other popular C project, has most of it's CVEs related to memory safety.https://app.opencve.io/cve/?vendor=sqlite
>>110190075>>110190079Rust derangement syndrome (RDS) is getting way out of hand. You guys need professional help. It's not healthy.
>>110193036Cope and seethe AI psychosed
>>110193261Huh. That's an interesting response to someone talking about things before contemporary AI slop.
>>110193296>2024>before aiAI psychosis status: 2 more weeks before AGI
>>110192617>but there's a reason rust code is significantly buggier on averageproof of this assertion?
>>110180289>But not of RCE'sthis vulnerability here allows RCE, anon
>>110195689sudo-rs, uutils and cloudflares nginx cloneAll of those three have significantly more bugs than what they try to replace.Which is an incredible accomplishment of the Rust community. You only had to copy something that exists, yet you made it less secure and more buggy.
>>110179273This vulnerability is far more serious than the php one.It is something you can actually exploit.
>>110195748>sudo-rs, uutils and cloudflares nginx clone>All of those three have significantly more bugs than what they try to replace.another assertion. can you show a bug tracker that proves your claim? to me it seems like you watched the youtube video of that lunduke fag who reported that uutils had a few bugs once and now treating it as "proof" of rust being generally buggier. If that is your standard of what proof is you are going to be taken advantage of in life a lot
>>110195760>The PHP copers are backhttps://stealmybitcoin.com/https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-serversPathetic retard.
>>110195789The php vulnerability requires you to chain at least three other exploits additionally to DDoSing the server.And despite 80% of the servers still being in vulnerable versions, none of them gets hacked.This Rust vulnerability works out of the box. You only need a zip file. No need to know or guess anything about your target.
>>110195847>despite 80% of the servers still being in vulnerableWhere did you pull this delusional bullshit from, retard?
>>110195903the 80% are from the website of php2shell
>>110195782I have to follow Ubuntu CVEs and every other day there is yet another vulnerability in some Rust replacement bullshit.A few days ago we had sudo-rs, now we have this.And thanks to Rusties being COMPLETE FUCKING IDIOTS DOING INSECURE SHIT you cant just update one library, nononono, every Rust bullshit thing that uses it needs to be updated and recompiled.Cargo is THE MOST DANGEROUS PRACTICE, and if you dont understand this, you are low IQ and not worth to be talked with.
>>110195945>I have to follow Ubuntu CVEs and every other day there is yet another vulnerability in some Rust replacement bullshit.and there isn't in C? Why not provide a link to a bug tracker where i can filter and graph the differences for myself?
>>110195945>Ubuntulol retard. Also doubt.
>>110196069Do you really think there's something wrong with Ubuntu? It's the best distribution, and the only legitimate reason not to use it is because Debian lets you install newer versions of software easier, or you're on Desktop and hate GNOME (because GNOME is really bad).
>>110195994>and there isnt in CThis discussion is about a comparison.Yes, sudo-rs produces more vulnerabilities than sudo.Yes, uutils produces more vulnerabilities than coreutils.Yes, the cloudflare Rust rewrite of nginx produces more downtime and crashes than nginx.>but but C applications also have bugsIs a dishonest argument you should get shot for.
>>110196191>Yes, sudo-rs produces more vulnerabilities than sudo.>Yes, uutils produces more vulnerabilities than coreutils.>Yes, the cloudflare Rust rewrite of nginx produces more downtime and crashes than nginx.we are 5 or so posts in and you are yet to provide proof of your baseless claims lunduke
>>110179273Rust is a language for SI, no human uses this garbage
>>110196214Take the L, rustroon
>>110196214>yes, you named popular examples, BUT you didnt provide a link to those projects and you cant expect from me to navigate the internethttps://github.com/trifectatechfoundation/sudo-rs/issueshas double the amount of issues ofhttps://github.com/sudo-project/sudo/issues
>>110196260cool. now let's filter for bugs...
>>110196248not an argument Cnile
>>110179273>Not on news>Not in reddit>Not on orange redditFake news. KYS.
>>110196342sudo has 0https://github.com/sudo-project/sudo/issues?q=is%3Aissue+state%3Aopen+label%3Abug
>>110179273php is more secure than Rust
>>110196385>the program that has been patched for 40+ years has less (found) bugs than the new softwareCniles are not sending their strongest today
>>110179871>Rust never claimed to have solved logic bugs.Memory corruption in C is a logic bug, C arrays are just data structures with implicit invariants and not respecting implicit invariants is a logic bug.
>>110196656anon, we are talking about projects that just had to rewrite existing code into Rust.You just have to copy something that exists, with the source code available.Yet they produce vulnerability after vulnerability.Worse vulnerabilities than the recent php nothingburger
>>110196368I wouldn't call it fake news, but handling zips, especially in a way that would be truly bad, is pretty uncommon.
>>110199173....ok? Is this post supposed to make some point?
>>110199218>hadLMAORust psychosis, a subclass of AI psychosis.
>>110179273>send a malicious zip file and you can overwrite whatever you wantnow THIS is an actually usable exploit, not like this php fearmongering was
>>110199307the completely unheard scenario of checking the content of a zip archive first, before extracting.
>>110200994The problem with op is that it inspects incorrectly.The problem with zip in general is that zip bombs are legal constructs that can't be differentiated before extraction starts. Technically it is not a software bug to process a zip bomb, because there is a concept of "streaming zips" that have "-1" for extracted size.
>>110180016le fishe
>>110201023OP has nothing to do with zip bombs.Its a bug in Rust zip-rs, and zip-rs only.
>>110179327>user-submitted ZIP filesYou're just begging to get pwned lmao
>>110202264Yes I know. The comment I replied to claimed it was simple to check the zip contents before extracting, I was explaining it was not because of what zip allows. I added an aside on zip bombs because they're a common """cve""" against zip libraries (fake CVEs) though that's a different problem than OP's (which is just legit retardation from rustfags as usual). In that case, the problem, as I stated, is that zip-rs does not properly inspect the contents, which is why inspecting wouldn't work (circular).
>>110200994anon, if your a computer service accepting dubious zips, you aren't just unzipping it as is. You're extracting filestreams and putting them somewhere carefully chosen.
>>110202301>which is just legit retardation from rustfags as usualif you don't understand why zips and tarballs are shit, you have no right to make this statement. Retards still manage to write HTTP request smuggling bugs and SMTP is full of them because of confusion around line terminators and \r\n. None of this has to do with Rust or C and everything to do with shit boomer codecs.
>>110202313Hey zoomer, have you tried doing this grand ol' thing called "reading"? Preferably before you hit send on your retarded nonsense.
>>110202309thats what this vulnerability is about, anon, the streaming part is the one fucking you over, because the zip-rs creators were too dumb to ensure that it gets you the same path and name.
>>110202313>>110202309This vulnerability doesnt exist in other zip libraries.Imagine looking at the content of a zip file and it says that there is a funny_cat.png and then you extract this and it overwrites ~/.bashrc with the content "rm -rf".This is what this vulnerability is about.You cant jew your way out of this with an "BUT BUT THE FORMAT IS BAAAD" when it is a YOU issue and YOU only.
>>110202317you aren't taking attacker controlled path names you fucking retard.that's like taking a multipart/form-data and using the filename to choose where to write the files to.
>>110202341>This vulnerability doesnt exist in other zip librariesthat you know of, or have large caveats carved out. Most zip libs are just doing the thing of parsing some retarded format like jar files, ooxml docs, etc. not extracting them to the filesystem.
>>110202346>>110202344You are illiterate and profoundly retarded
>>110202344>you aren't taking attacker controlled path names you fucking retard.Thats what the issue is about, zip-rs streaming interprets it differently.You are correct in your statement that this is a rookie mistake only absolute baboons would do... and those baboons are the Rust coders writing zip-rs.This CVS has a score of 10.0The php nothingburger had 9.2Do you agree with me that the Rust troon, who did this, deserves to get executed?
>>110202351I accept your concession.
>>110202346This vulnerability does not exist in other zip libraries
>>110202357Why yes, I'll take fries with that.
>>110202356>Do you agree with me that the Rust troon, who did this, deserves to get executed?The Rust troon in question is Chris Hennick, backend engineer at AWS.After cloudflare showed us that even huge corpos can't produce safe Rust code, and Canonical confirmed it, it is now AWS turn.What will be the next corpo that gets hacked because of Rust?
>>110202356>zip-rs streaming interprets it differentlywhich is a nothingburger unless you rely on ::extract, which is fucking retarded. again, it's like blindly extracting a filename:data from an multipart/form-data as-is.
>>110202399>AWSsoooo, the current Binance (hosted on AWS) hack happened because of this?Looking at >>110179327 lmao
>>110202410>its a nothingburgerAmazon AWS disagrees here
>>110202438and the CVE numberer is fucking retarded. this is a 7 at best.
>>110202475It is a far more serious issue than the php thing, anon.Even you have to agree to this.If you want to downrate this to a 7, what do you judge the php thing on? A 1?
>>110202477>It is a far more serious issue than the php thingno it isn't. people got hacked for the PHP issue. no one is getting hacked by this, unless they were retarded or the zip contained contents that had to be trustworthy anyway.
>>110202489>people got hacked for the PHP issueSource?
>>110202489expoiting php issue:>know the exact versions and gear of the victim>know its memory layout>ask the victim to provide you with a special vulnerable configuration>DDoS the victim for hundreds of hours to pin a worker>throw other workers into OOM by using other exploits>randomly test stuff to the worker hoping something fits>cause segfaults in the process>ask victim to keep ignoring that and restartingexploiting zip-rs issue:>send a zip file
>>110202489How do you check if a zip contains content that is malicious?Isn't this something that every cloud service, including AWS, does?And what library is AWS using?And where was Binance hosted, which got hacked and billions stolen just today?
>>110202522>>exploiting zip-rs issue:>>>send a zip file>nothing happens because the zip was trusted anyway and you look like a dumb nigger like the people hyping up the tar smuggling vuln in uvok retard.
>27 security-advisory reports, 18 of which arrived so far this month>the moment a fix is released and I do it, people don't update>The only partial exception was a few days ago when I yanked all the known-insecure versions -- which people only *then* saw fit to tell me wasn't the recommended practicekek
>>110202546How would AWS scan zips for malicious content without streaming its content?>muh "trusted"how does it decide what is "trusted"?
>>110202561>without streaming its contentactually read the vuln to realize this is not the issue.
>>110202567can you answer the question?
>>110202561>how does it decide what is "trusted"?when it requires authentication and an understanding by the user and the service that malformed zips can cause issues for them.I am racking by brain trying to come up with a use-case where a mallicious user has a zip, that needs to be extracted as-is, relying on local header-names to confuse a specific library, that somehow overwrites something constrained to an extracted directory path that could allow for actual code execution.it is such a retarded and contrived levels of bad architecture, I just can't. At best I can see a malicious user trying to trick some retard to upload a crafted zip to do something, but there are many more lower hanging vulns that don't rely on this specific target of parser desync to attack such a user.please, prove me wrong here, tardo.
>>110202552This is the single most retarded dev I've ever seen, it's obvious he's pajeetcoding the whole thing using gpt or something.
Can someone name even one single Rust written project that doesn't produce vulnerabilities on mass?Is there even one single Rust project that is good?sudo-rs is trashuutils is trashcloudflares Rust garbage is trashAWS Rust garbage is trashAsahi Linux mac drivers are trashIs there anything that is good?
>>110202573Can you read the report? This is specifically one helper function which gets a stream of zip entries and accepts the local entry's name. Since most users check the central archive, this desync can be problematic. If you're enumerating the entries by hand, as you should anyway, this is literally next to a nothing burger.
>>110202598>Can you read the report?yes>Who is Impacted:>Automated ingestion microservices, SaaS platforms, and backend workers that extract user-submitted ZIP files.>Enterprise architectures where security verification (AV scanning, extension whitelisting) is decoupled from extraction (e.g. gateway audits Central Directory via CDFH before handing off extraction to streaming extractors).>Containerized workloads where overwriting local configuration files or executable scripts leads to host/container escape and complete service disruption.
>>110202603Who is impacted: people who use ZipStreamReader::extract. Keep being retarded.
arguing:>nobody should ever be extracting zip files anywayis like arguing:>nobody should accept POST requests anywayIf someone would have argued about the php vulnerability (which actually was a nothingburger) with such a cope, he would have been laughed at. But here we see Rust troons legitimately arguing this way.So dumb.
What is the cause of Rust Derangement Syndrome? Have psychologists studied this?
>>110202610yeah, so like AWS>you aren't supposed to run an SaaS Cloud serviceyeah, i agree with thisBut if they would have used a different zip library, they wouldn't have gotten hacked.
>>110179273I don't use Rust shit, so it isn't my problem.Sucks for Cloudflare, AWS, Google and Microsoft, though
>>110202621AWS would be extracting zips in cases where there is an implicit contract between users and AWS that their zip is not malicious. AWS has systems in place to isolate tenants from each other, so at best, they'd self-harm themselves Where in AWS is this an issue? Oh no some retard was tricked into uploading a malicious .zip for their lambdaThe lambda is already executing arbitrary fucking code.
>>110202552> it's prevented me from claiming my unemployment benefits by leaving me too little time to fulfill the 3-job-applications-per-week requirement that Washington State imposes.kek, Rust troon got layed offTotal Rustoid unemployment
Has anyone considered rewriting Rust....in Rust???
>>110202639>the user signed a contract and promised to not abuse active security vulnerabilitiesok
>>110202658That's not what I said you fucking dumb nigger. Holy shit. You literally have no argument.
>>110202652The Rust compiler is written in C++ and they attempt to rewrite Rust in Rust for over a decade now... i think they gave up on it
>>110202663You mean llvm?
>>110202663anon, are you retarded?
>>110202666yesThey also reimplemented rustc in C++ again, because the bootstrapping wasn't reproducible.Rustc got bootstrapped by ocaml written hacks that iterated so many times that nobody knows what built what anymore.https://github.com/thepowersgang/mrustc
>>110202704I didn't know about rustc reimpl. Extremely embarrassing. Regarding llvm I knew about it but considered it an external dep. Llvm is well known to be a total shitshow and any compiler relying on it is automatically a bad idea, it really sucks they have never managed to move away from it.
>>110202758not many choices.gcc is too gcc specific.qbe is meme toy one.cranelift is in dev-hell because e-graphs aren't easy, but at least has some real uses and users. llvm is basically the worse is better tier thing in our world. everyone who's a compiler pro(tm) knows how to work with it, or should or is already paid to shit up gcc.
>>110202904The problem with llvm is that it's a massively buggy piece of shit that also happens to change everything with very poor to no documentation every sub-point version. The result is that you need a team of 10+ just to keep up, or you version a fixed snapshot and never update (what nearly everyone does in practice). Also, the official bindings don't generate valid llvm ir, so you have to do it yourself every time (which puts the onus on you to update the ir every subpoint version).The fact is you don't need to piggyback on another compiler. Just output assembly for your platform, or even straight machine code (i.e. implement a purpose-specific assembler). This is what all serious languages do. If you need something else because you're very early with your language or not very serious about it, compile to C, and compile the C with either tcc or gcc depending on the purpose (you can use tcc in-memory for jit for example).
>>110202920ya, it's crazy innit?Wish people would put money into literally anything else, but Apple is probably single-handedly keeping it up with the money they pour.Rust does like you said, just keeps their own fork-off to protect themselves. I don't blame them and I imagine every LLVM user who's serious has to. Sad!
>>110202904>gcc is too gcc specificgcc can be bootstrapped with and assembly -> tinyc -> gcc pipelineIf Rustlets would have used gcc to begin with, they wouldn't be spending years of effort now trying to... write a C++ mrustc implementation to bootstrap rustc by utilising gcc in the chain.LLVM is shit.And that is independent of Rust.It is a big pile of garbage with a million proprietary corpo forks.Rustlets chose it because Rust is a corpo project and they simply do not want GPLv3 gcc.You are using inferior crap because of some corpo tard dislikes a License.
>>110202938good for GCC? now go make your backend use it.https://github.com/rust-lang/rustc_codegen_gcclibgccjit (hilariously unfortunate name) is basically your best window into it and you lose a lot of things you get from llvm for free, at least from a dev experience.
>>110202938LLVM is also slow, convoluted to work with and has much worse platform support.
>>110202953GCC has a dedicated system for frontend and backend "plugins". It's a bit of a pain to work with, but it works. It's why you can have gcc-ada, gcc-c and gcc-c++.
>>110202904>everyone who's a compiler pro(tm) knows how to work with itIs this what some corpo serf, who hates his job, told you?
>>110202971I wouldn't say "much worse" because frankly it covers 99.9% of useful platforms. It's an argument, but not relevant to the main rust audiences.
>>110202973no, it's why they're all shoved into the gcc frontend. no one gives a shit.
>>110202981it covers less than gccIt is simply objectively inferior.And corpos only use it because of its license.And they fuck each other over. So corpo A uses an LLVM fork with proprietary shit thrown on top of it that corpo B doesn't have, and they keep creating incompatibilities.
>>110202971LLVM at least divides platforms by specific support tiers. GCC doesn't and so you have people use shit like the mips backend thinking it's good and it's actual dogshit.
>>110202983Are you butthurt that you can't build proprietary garbage on top of it?
>>110202977if you're paid a salary to do compiler shit, you're either fighting with GCC or an LLVM derivative.
>>110202997>It is simply objectively inferior.>it covers less than gccYes, I'm just saying that it's also 100x the complexity (due to all the different backends) for 0.01% userbase that they don't even care about. Of course it's objectively a loss, but not one that matters materially.>And corpos only use it because of its license.Yes, it's pretty obvious. LLVM is terrible for both users and developers.
>>110202552>archive repo>yank ALL VERSIONS bar none>leave a note telling users to wrap ppmd themselves or fork if they really careso hard, is it?you may think it's the opposite, but the worst open-source maintainers are those who care. and this is more common among those who come into the "position" without being original developers themselves, which is ironic, since, baring a literal bus getting involved or some shit, if a project really mattered, the original dev(s) would have continued maintaining it.this is not uncommon a problem in open-source, unfortunately.
