Of course Phoronix does not report the important follow up message in the thread:
Rust is already a hard requirement on all Debian release architectures and ports except for alpha, hppa, m68k, and sh4 (which do not provide sqv).
Of course Phoronix does not report the important follow up message in the thread:
Rust is already a hard requirement on all Debian release architectures and ports except for alpha, hppa, m68k, and sh4 (which do not provide sqv).
not be held back by trying to shoehorn modern software on retro computing devices.
So I admit that I am just a user and have basically no idea what goes on behind the scenes in development, but for me, shoehorning stuff into retro devices is kind of a defining feature of Linux. It runs on just about everything, full stop. I suppose that can be a blessing and a curse, but it does make me a little sad especially in the context of this rust fever where everyone seems to think that this one thing will magically solve all the problems. Seems a bit short-sighted to me. Also because I thought I'd move to Debian since Ubuntu has been forcing snaps onto me...
Is it just me, or does that seem .. abrupt?
There's time until March for the maintainers of the 3 niche architectures to organize and make rust available for them. Doesn't sound that abrupt to me
For small niches, six months can be rather aprupt.
Wasn't there a Rust-to-C compiler that would circumvent this limitation?
For package maintainers, it's reasonable to expect security updates are rolled out the same week that a vulnerability is found. If you can't deploy a new version of a package in 6 months, not maintaining the package is also a valid option.
The timeline is not super abrupt, especially for architectures where all he is asking is to ensure that your Rust toolchain is in order. That is especially true when you consider that Rust is already well maintained on all the Debian architectures that people actually use.
The abruptness (almost rudeness) is in the second part where he basically says that, if you cannot get Rust going in time, you should just stop releasing Debian for that architecture.
It is mostly just poorly worded though. Because none of these architectures have “official” support even now. This will not be the only way they are behind. So, there is not reason to be so dramatic.
And that would be my response to him. Another option here is that these alternative architectures just continue to ship an older version of APT for now. Emergency avoided. Few of them ship with up-to-date versions of APT even now.
Another solution is to use one of the multiple projects that is working to make Rust code build with the GCC compiler back-end. At least one of these projects has already announced that they want to work with these Debian variants to ensure that APT builds with them.
So, the 6 month timeline is a reasonable impetus to make that happen which would be quite a good thing beyond just APT.
There are many other useful tools written in Rust you are going to want to use on these architectures. It will be a fantastic outcome if this pressure from APT kickstarts that happening for some of these long abandoned architectures (by the mainstream at least).
Rust adds another layer of trusting the compiler isn't backdoored. All UNIX/Linux systems use the gcc toolchain, so having it written in C would mean less dependencies for the OS.
Strange times.
how many compiler back doors have we seen versus use-after-free/stack overflow attacks?
Who cares? Why do you ask?
The anti-Rust crowd baffles me. Maybe C++ has rotted their brain to the point they can’t “get” the borrow checker.
I can't code, so C++ doesn't have much space in my brain, but Rust still seems a lot more sus to me than C.
You care
About random numbers? Not really
you are the one that brought it up as an issue with rust.
Are you referring to where I said "I want to know some random numbers Rust isn't giving me, and that's a problem with Rust?"
Because that was in your imagination.
Or are you referring to where I said "Rust wants to know some random numbers it isn't giving itself?"
Because that was also in your imagination.
In reality, I brought up that I've heard Rust adds another layer of trusting the compiler isn’t backdoored.
And while you bring up a "boo-hoo, software written in C has bugs" common knowledge, to my best knowledge standard Rust library still has unsafe parts. But that's no problem, because contracts, sure. Thanks for demonstrating how full of nonsense you are, bye
While you're spouting nonsense
I'm the guy you were replying to here. I'm not spouting any nonsense in this thread. Did you reply to the wrong person, or is this a false accusation?
this is happening:
https://www.infoq.com/news/2025/11/redis-vulnerability-redishell/
The vulnerability exploits a 13-year-old UAF memory corruption bug in Redis, allowing a post-auth attacker to send a crafted Lua script to escape the default Lua sandbox and execute arbitrary native code. This grants full host access, enabling data theft, wiping, encryption, resource hijacking, and lateral movement within cloud environments.
13 years. That’s how long it took to find a critical safety vulnerability in one of the most popular C open source codebases, Redis. This is software that was expertly written by some of the best engineers in the world and yet, mistakes can still happen! It’s just that in C a “mistake” can often mean a memory-safety bug that would put user data at risk (…) That’s the nature of memory-safety bugs in C: they can hide in plain sight.
Why did you make me read these paragraphs without explaining how they connect to the context? Let me guess: they don't connect to the context, you're just designing your replies to mislead people dumb enough to be vulnerable to your manipulation tactics? With no consideration for me whose time/energy you're wasting, much less them who you're confusing?
For anyone confused:
I have no horse in this fight, so pardon my asking:
You self admittidly don't know code, so like, why are you trying to argue about code?
That's like a DJ and a Barber arguing over which carbueretor jet is correct in a classic Mercedes. The answer is muddier and than either of them know enough to understand, because they're not mechanics or engineers.
Are you a programmer? Cybersecurity researcher? Bot designed to sow discontent with pretty arguement?
Like, what's the point of all this? Neither of you know what you're talking about, I don't even know what you're talking about but I can clearly read the vibes based technobabble between you, so like, why?
You self admittidly don’t know code, so like, why are you trying to argue about code?
Because the level of knowledge that would stop you from rephrasing my words into "don't know code" is much higher than the level of knowledge I'm using in the argument.
That’s like a DJ and a Barber arguing over which carbueretor jet is correct in a classic Mercedes. The answer is muddier and than either of them know enough to understand, because they’re not mechanics or engineers.
How is that like an unpaid cybersecurity expert arguing about cybersecurity then?
Are you a programmer?
Already answered this and you acknowledged that in the beginning. It's becoming clearer and clearer you're replying in purely bad faith.
Cybersecurity researcher?
Kinda, but not really.
Bot designed to sow discontent with pretty arguement?
Obviously not, and now it seems like you're trying to bait me into the kind of response that could get me banned here. This discussion would be more appropriate for nostr, where no one can be banned.
Like, what’s the point of all this?
The main point of your gish gallop is to waste my time and energy and confuse other people.
The main point on my side of the discussion has been to raise awareness of how concerned the general public should be (and sadly isn't) about the general state of cybersecurity right now, especially in vital areas like how the Linux ecosystem and coding languages themselves are developing.
Neither of you know what you’re talking about
Incorrect. I have talked about, for example, a user's statements in a discussion I linked to. I know this. You can't really provide an example of anything I've mentioned here that I don't know about.
You could use "don't know what you're talking about" as a euphemism for how the person I was replying to was spewing bullshit, but I'd just call them a liar. Seems more straightforward. Either way, that's not me.
don’t even know what you’re talking about but I can clearly read the vibes based technobabble between you
I think in this context, you should be trying to ignore the vibes and understand what's being said.
so like, why?
Awareness should be raised for this stuff, because people are sadly not as concerned as they should be about the state of cybersecurity right now. It's particularly an issue in Linux / FOSS circles where there seems to be more of a false sense of security these days.
What do you mean?
the only loss here is my time as a moderator :P
I am not banning anyone, you were quite civil in this "fight" ^1^
Do keep in mind that all this has a lot of "editor wars" vibes. But the conflict goes beyond Debian (e.g. including Rust in Linux kernel), and actual harmful discussions between Rust and C/C++ people is REAL, damaging our communities, and very much driven by generations/ network-effect. And this is just sad. It's not a technical issue, and overcoming it seems nearly impossible at the moment.
--
^1^ I'd call it discussion, but it seems to me that 'whoever loves Digit' was ranting more on their own behalf... as per their own words:
Awareness should be raised for this stuff, because people are sadly not as concerned as they should be about the state of cybersecurity right now. It's particularly an issue in Linux / FOSS circles where there seems to be more of a false sense of security these days.
I agree with these words, but not all you said (specifically, backdoors to me are a smaller concern in the software industry nowadays in comparison to the Redishell provided that you were unable to fully understand). Anyway, I don't see reason to remove any of the most downvoted comments you have. But I will take the opportunity here to raise a warning to you. OR, let's make it a personal advice: arguing on the internet is not worth the emotional toll. As with any advice, you can either take it or leave it. Good luck!
the only loss here is my time as a moderator :P
I value mine more than yours, sorry.
Do keep in mind that all this has a lot of “editor wars” vibes. But the conflict goes beyond Debian (e.g. including Rust in Linux kernel), and actual harmful discussions between Rust and C/C++ people is REAL, damaging our communities, and very much driven by generations/ network-effect. And this is just sad. It’s not a technical issue, and overcoming it seems nearly impossible at the moment.
Is this the reason you give me a "warning" later in your reply? I'm not getting the exact point clearly. This topic is "harmful," but I don't think you warned everyone else discussing it? So what is the actual warning? Are you telling me not to reply in threads on this topic in the future?
backdoors to me are a smaller concern in the software industry nowadays in comparison to the Redishell provided that you were unable to fully understand
Backdoors are a top priority concern in consumer electronics. I hope nobody lets themselves be mislead on that fact here.
I have no idea what "Redishell" is. I don't think there was any point in this thread where I said anything about it, so what are you talking about with me being "unable to fully understand" it? Couldn't you try telling me what it is and checking how much I understand before saying that? Am I totally forgetting something?
Whatever it is, it sounds like you're implying it's a security vulnerability that cannot be a backdoor, which I definitely don't understand when I have no idea what it is.
I am not saying this as a moderator: you're person of obnoxious answers. Probably far too intelligent to even consider that you're actually interacting with other human beings that may not want to engage or sacrifice their time with your rants. But I don't ban based on personality.
Anyway, I don't have to answer any of your questions. Typing comes too fast on your keyboard. Try stepping away, read, click the links (like redishiel CVE), take a deep breath, live more calmly.
I will post a reply to you reply on Redishell. So that you can check again what happened there. You went too fast and hit your own wall.
If your experience tells you the open source community is less vulnerable to backdoors or something, reconsider that.
I only said that I agreed with you in those words...
Do you think backdoors are the only threat? or the biggest?? in both cases, you'd be wrong. That's the whole point in this exchange of opinions.
Rust seems sus to you? What’s that based on, “vibes, bro”?
Essentially, yeah.
Noticed an overall "vibe" where Rust critics repeatedly have points that sound like they make sense, and I can't really think of examples of them saying confusing nonsense, or refusing to elaborate on a point when challenged to. Whereas, other way around for Rust defenders.
Best way I know to determine what's "sus" is to look at what's defended by people who are willing to elaborate on the points you ask them to elaborate on. It's almost a perfect gauge. But maybe not quite perfect, and you could totally call it "vibes." I remain not totally certain about Rust.
If you are not a programmer, you do not have the background or understanding to assess any arguments about a programing language.
The vast majority of anti-Rust people are stubborn and toxic types who don’t know it and refuse to learn. On the other end you have those who do use it, know why it’s such a good language, and criticize it constructively so that it continues to improve. Rust lacks many quality of life features that other languages have, but that is by design. It’s meant to create rock-solid software and forces you to think about things like lifetimes and ownership scopes that other languages let you take for granted.
You can’t easily move from languages like C++ or Python to Rust without learning and accepting new concepts and patterns. If someone can’t or won’t do that, they should not be doing any programming.
It's very hard to get a good look at which arguments are good or not without having the experience to evaluate them.
Here's my view on Rust vs C or C++. Rust is a stricter language which makes it easier to code with low run-time errors, which is great for writing large scale projects. Now the problem with this is that you can write C++ to also be strict but it's a lot more verbose than the standard approach, so most developers don't. This causes disagreement among Rustaceans and C/C++'ers. The C++'ers are correct that you can replicate anything in Rust in C++. A correct program is a correct program regardless of the language it's written in. Rustaceans also oversell when it comes to program correctness, tons of Rust programs have errors; Rust can help minimize errors but it's not a silver bullet. Rewriting-in-Rust for an already good program is a fools errand; the outcome will probably be a worse program. However Rustaceans are correct in pointing out that the C++ written programs tend to have more errors, it's just not the rule they pretend it is.
In summary, Rust is a great language but Rustaceans oversell it. Many of it's apparent advantages can be mitigated by good development practice. It's just that good practices are difficult and uncommon.
(Note that there are also 3-rd party tools like static analysers, which can help developers detect errors. So again Rust is better out of the box, but ultimately you can get the same outcome with some work).
More like Rust has rotted someone's brain. "Hey, I can't code safely, so I will use this new toy that is supposed to make me". This line of thought is OK as long as it does not get imposed on anything I do as a programmer
The industry cannot code safely. There are many reports, studies, and corporate disclosures highlighting that memory related bugs are the primary source of critical security issues in C and C++ code. That is why even NIH companies like Google and Microsoft are adopting Rust in their core products.
That you want to publicly ignore all that evidence to paint it as an individual skill issue does not come across as competent or intelligent. Few of us are going to assume your code is free of these kinds of bugs.
The fact that your have to say it so dismissively makes me think that you know it too.
Things are much simpler:
Want a bug free code - do bug free code. Spend time carefully evaluating every line and interaction
Want third-party code and safety - examine that code in the same way
Whatever you do, assume there is a bug in any software you use, so plan and organize accordingly
No amount of magic pills can substitute the above. So yeah, it is a skill issue. Also an issue of kids wining that there are bugs and they don't feel safe, so they want to cling to magic pills instead of dealing with the reality
It's not a "magic pill", it's another tool. We're not saying that it will magically fix everything, it will just make certain types of errors less probable.
If you want bug-free code, will you (A) use a tool that makes it easier, or (B) use the same tool as before?
"Skill issue" is not an answer.
Wrong reasoning, friend:
Maybe C++ has rotted their brain to the point they can’t “get” the borrow checker.
Yeah, sure. Borrow checker fixes all. This is exactly the idiot attitude I am addressing.
And if I want a bug-free code, I will use same tool as ever: my brain
I am not the person who said "C++ has rotted their brain". I have not expressed a similar sentiment. I have never said that "borrow checker fixes all", in fact I said that it will not magically fix everything.
And if I want a bug-free code, I will use same tool as ever: my brain
Is your brain infallible?
The strategy is not to 100% eliminate every bug in existence or theory, bugs are inevitable. The strategy is Swiss cheese security.
Something is better than nothing. Therefore (brain + something) > (brain + nothing). As long as "something" works to prevent bugs, to any extent, it will result in fewer bugs.
I am not the person who said “C++ has rotted their brain”
Right. So what do you want with me?
Is your brain infallible?
No, but human brain is the only thing that can define bug
As long as “something” works to prevent bugs, to any extent, it will result in fewer bugs.
Any programming language does
Strange how your bad faith reply is still here, and with many upvotes, while my reply calling you out appears to be gone.
This is an example of how discussions like this are more appropriate for nostr, where there are no bans / post removals.
You know that bans/removals are documented right? If you don't see your post it's because you didn't post it. You're not being censored, go take your meds
Weak gaslighting attempt but if you could show me where to find it documented I would appreciate that.
If anyone is confused, feel free to ask me for proof I'm telling the truth. If I posted it here, I'm pretty sure I'd be at risk of getting banned for evading the post removal (because the proof would also lead you back to the reply chain that was removed)
Edit - maybe this counts as proof without showing any removed content:
https://piefed.social/post/1458050/comment/8784509#replies
If you click the link, it's blank, yet it has a "parent comment" link that leads to where I was replying
Edit 2 - tried to post an archive link but archive.org didn't seem to work the way I thought?
Is the link I posted above showing what I described for other users?
Can confirm that post still exists. I just downvoted it. Still exists when I open the link you posted in a browser, too, just collapsed.
Nope, not seeing it there
Yeah I know you don't. It's because your comments aren't being removed
So this link shows a comment for you, not just a blank space? https://piefed.social/post/1458050/comment/8784509#replies
Here's a screenshot of what I'm seeing

There's an ongoing effort to get gcc to compile Rust.^[https://lwn.net/Articles/907405/]
So thats why whenever I try to find a package in apt, I have to iterate through thousands of simiparly named librust-{dictionaryword}-{component}-dev packages in order to find the simple component I want... Apt repos have really been trying too hard for granularity, I'm pretty sure there are more librust áckages than actual end-user program packages.
Still gonna use Debian.
Tells something about apt. Not because Rust bad or anything, but because Rust is more like C++ than C.
Apt is written in more C++ than C, so it would be apt to select a language that is similar.
What does this mean for the end-user? By how they worded it...
the APT packaging tool next year will begin requiring a Rust compiler
it seems like you need a Rust compiler as a dependency for simply having Apt installed on your system.
Debian and most distros based on it do not even install a C++ compiler by default, and apt is mostly written in C++.
Maybe cause Apt is slow?
edit: maybe i have a placebo effect or i am miss remembering :P
Compared to what?
I know redhat has a new package manager which name I can't recall now but before it was rpm with yum and holy crap that was molasses slow
Apt feels like one of the faster package managers. dnf is slow, yum is snail speed, zypper is slow as fuck too. Apt and Pacman is by far on the faster side
This shoehorning of Rust feels more artificial than Wayland's. 🤔
You can think yhat Wayland adoption was artificial, bit X.Org is unmaintained software and no developers are picking up reigns of X11. X is dead.
Uhm, what?
Wayland has been in the works for more than a decade. Granted, there's some people having issues with it, with propietary hardware (nVidia) and not-so-common setups like two monitors, but it happens that they are the most noisy. For the rest of us it's been great, stable, and feels snappier than X.
If you want to talk about shoehorning stuff into Debian, talk about systemd.
not-so-common setups like two monitors
wat.jpg
the ONLY thing I can think of is sometimes, at least for me, on wayland it will switch the naming on my second monitor between either DP-1 or HDMI-A-1 randomly for whatever reason. bit of a very minor pain if I'm using a WM where I have to go in and edit the config to switch it but on KDE it's not an issue. that's literally the only thing I can think of.
I assume "weird two-monitors setups" that are not so common, not two-monitor setups as a whole, as Wayland works perfectly with two monitors. It even works way better than X11 if your monitors are different, like if only one has VRR or if both monitors need different scaling.
Second that. The person just needs to pull a cable into a cheap second-hand screen he/she bought and it's pretty much done, so I can't see why it wouldn't be common.
Yeah that’s quite silly. Every single employee at my office is issued 2 monitors to go with their company laptop. People working from home get the monitors shipped to them. It’s the standard setup in tons of offices as well as for many home users.
Explaining, changes happening too abruptly feel artificial. Wayland's been around for a while, sure, but it was barely adopted and then a lot of people started insisting on it overnight.
There is this really strange perception amongst Wayland critics that it had low market share and nobody was using it.
The majority of Linux desktop users are on Wayland and we still have people posting that nobody is using it or even that it “doesn’t work”.
Wayland switched to the default in places where it was already popular and is becoming required in places where few are switching away from the default.
oh man, and here I was about to finish migration to Debian.
Are you migrating to Debian on a niche CPU architecture? If not, this doesn't affect you.
currently running on a P2 333mhz. I guess it's pretty common though.
Didn't Debian drop i386? Are you running Debian Bookworm?
all 3 comments