Benefits and Drawbacks of Adopting a Secure Programming Language: Rust As a Case Study
Total Page：16
File Type：pdf, Size：1020Kb
Benefits and Drawbacks of Adopting a Secure Programming Language: Rust as a Case Study Kelsey R. Fulton, Anna Chan, Daniel Votipka†, Michael Hicks, and Michelle L. Mazurek University of Maryland †Tufts University Abstract ties have remained a consistent, and sometimes worsening, Programming languages such as Rust and Go were devel- threat [37], with estimates that 60-70% of critical vulnerabili- oped to combat common and potentially devastating memory- ties in Chrome [13], Microsoft products [7] and in other large safety-related vulnerabilities. But adoption of new, more se- critical systems [12] owe to memory safety vulnerabilities. cure languages can be fraught and complex. To better under- Overwhelmingly, memory safety vulnerabilites occur in stand the benefits and challenges of adopting Rust in partic- C and C++ code—while most popular languages enforce ular, we conducted semi-structured interviews with profes- memory safety automatically, C and C++ do not [43, 47]. sional, primarily senior software developers who have worked Relatively recently, Google developed Go [14] and Mozilla with Rust on their teams or tried to introduce it (n = 16), and developed Rust [33] to be practical but secure alternatives to we deployed a survey to the Rust development community C and C++; these languages aim to be fast, low-level, and (n = 178). We asked participants about their personal experi- type- and memory-safe [34,40]. Rust and Go have been rising ences using Rust, as well as experiences using Rust at their in popularity—IEEE’s 2019 Top Programming languages list companies. We find a range of positive features, including ranks them 17 and 10, respectively—but C and C++ continue good tooling and documentation, benefits for the development to occupy top spots (3 and 4). We might wonder: What are lifecycle, and improvement of overall secure coding skills, as the factors fueling the rise of these secure languages? Is there well as drawbacks including a steep learning curve, limited li- a chance they will overtake their insecure counterparts, C and brary support, and concerns about the ability to hire additional C++, and if so, how? Rust developers in the future. Our results have implications In this paper, we attempt to answer these questions for Rust, for promoting the adoption of Rust specifically and secure in particular. While Go is extremely popular, Rust’s popular- programming languages and tools more generally. ity has also risen sharply in the last few years [9,15,34,39,46]. Rust’s “zero-cost abstractions” and its lack of garbage col- lection make it appropriate for resource-constrained environ- 1 Introduction ments, where Go would be less appropriate and C and C++ have traditionally been the only game in town. Secure software development is a difficult and important task. Vulnerabilities are still discovered in production code on a reg- We conducted semi-structured interviews with professional, ular basis [4,27,38], and many of these arise from highly dan- primarily senior developers who have actively worked with gerous violations of memory safety, such as use-after-frees, Rust on their product teams, and/or attempted to get their com- buffer overflows, and out-of-bounds reads/writes [28–32]. panies to adopt Rust (n = 16). We also surveyed participants Despite their long history and the many attempts aimed at in Rust development community forums (n = 178). We asked mitigating or blocking their exploitation, such vulnerabili- participants about their general programming experience and experiences using and adopting Rust both personally and at a company. We also asked about the benefits and drawbacks of using Rust in both settings. By asking these questions, we aim to understand the challenges that inhibit adoption, the net benefits (if any) that accrue after adoption, and what tactics Copyright is held by the author/owner. Permission to make digital or hard have been (un)successful in driving adoption and use. copies of all or part of this work for personal or classroom use is granted Our survey population likely represents those who view without fee. USENIX Symposium on Usable Privacy and Security (SOUPS) 2021. Rust at least somewhat positively, since we would not expect August 8–10, 2021, Virtual Conference. those who tried Rust and abandoned it to be members of Rust forums. That said, our survey population comprised people For those with a deeper interest, we recommend the tutorial with a variety of general and Rust-specific development expe- offered in the official Rust Programming Language Book [21]. rience. 26% of respondents had used Rust for less than one year and they often held similar opinions to more experienced 2.1 Core features and ecosystem Rust users. Our results uncovered a wide variety of specific challenges and benefits which can provide novel insights into Rust is a multi-paradigm language, with elements drawn from the human factors of secure language adoption. functional, imperative, and object oriented languages. Rust’s Participants largely perceived Rust to succeed at its goals traits abstract behavior that types can have in common, sim- of security and performance. Other key strengths identified ilarly to interfaces in Java of typeclasses in Haskell. Traits by participants include an active community, high-quality can be applied to any type, and types need not specifically documentation, and clear error messages, all of which make mention them in their definitions. Objects can be encoded it easy to find solutions to problems. Further, participants using traits and structures. Rust also supports generics and indicated that overall Rust benefits the development cycle in modules, and a sophisticated macro system. Rust’s variables both speed and quality, and using Rust improved their mental are immutable by default: once a value is bound to a vari- models of secure programming in ways that extend to other able, the variable cannot be changed unless it is specifically languages. annotated as mutable. Immutability eases safe code composi- However, participants also noted key drawbacks that can tion, and plays well with ownership, described shortly. Rust inhibit adoption, most seriously a steep learning curve to also enjoys local type inference: types on local variables are adjust to the paradigms that enforce security guarantees. Other generally optional, and can be inferred from their initializer. concerns included dependency bloat, limited library support, Rust also supports tagged unions (“enums”) and pattern slow compile times, high up-front costs, worries about future matching, which allow it to, for example, avoid the need for stability and maintenance, and apprehension about the ability a null value (the “billion dollar mistake” [19]). to hire Rust programmers going forward. For our participants, Rust has an integrated build system and package man- these negatives, while important, were generally outweighed ager called Cargo, which downloads library packages, called by the positive aspects of the language. crates, as needed, during builds. Rust has an official commu- Lastly, participants offered advice for others wanting to ad- nity package registry called crates.io. At the time of writing, vocate adoption of Rust or other secure languages: be patient, Crates.io lists more than 49,000 crates. pick projects playing to the language’s strengths, and offer support and mentorship during the transition. 2.2 Ownership and Lifetimes Analyzing our findings, we offer recommendations aimed at supporting greater adoption of Rust in particular and se- To avoid dangerous, security-relevant errors involving ref- cure languages generally. The popularity of Rust with our erences, Rust enforces a programming discipline involving participants highlights the importance of the ecosystem — ownership, borrowing, and lifetimes. tooling, documentation, community — when developing se- Ownership. Most type-safe languages use garbage col- cure languages and tools that users will actually want to use. lection to prevent the possibility of using a pointer after its Our results also suggest that perhaps the most critical path memory has been freed. Rust prevents this without garbage toward increased adoption of Rust in particular is to flatten collection by enforcing a strict ownership-based programming its learning curve, perhaps by finding ways to gradually train discipline involving three rules, enforced by the compiler: developers to use Rust’s ownership and lifetimes. Further, we 1. Each value in Rust has a variable that is its owner. find that much of the cost of adoption occurs up front, while 2. There can only be one owner at a time for each value. benefits tend to accrue later and with more uncertainty; secu- 3. A value is dropped when its owner goes out of scope. rity advocates should look for ways to rebalance this calculus An example of these rules can be seen in Listing1. In this by investing in a pipeline of trained developers and contribut- example, a is the owner of the value “example.” The scope ing to the longevity and stability of the Rust ecosystem. of a starts when a is created on line 3. The scope of a ends on line 5, so the value of a is then dropped. In the second x 2 Background block of code, is the initial owner of the value “example.” Ownership is then transferred to y on line 11, which is why the print on line 13 fails. The value cannot have two owners. Rust is an open-source systems programming language cre- ated by Mozilla, with its first stable release in 2014. Rust’s Borrowing. Since Rust does not allow values to have more creators promote its ability to “help developers create fast, than one owner, a non-owner wanting to use the value must secure applications” and argue that Rust “prevents segmenta- borrow a reference to a value. A borrow may take place so tion faults and guarantees thread safety.” This section presents long as the following invariant is maintained: There can be (a) Rust’s basic setup and how it aims to achieve these benefits.