Ubuntu explores replacing gnu utils with rust based uutils
-
I fear moving away from GPL that moving to Rust seems to bring, but Rust does fix real memory issues.
Take the recent rsync vulnerabilities for example.
At least this one in a Rust implementation of rsync would have very likely been avoided:
CVE-2024-12085 – A flaw was found in the rsync daemon which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. Info Leak via uninitialized Stack contents defeats ASLR.
I fear moving away from GPL that moving to Rust seems to bring, but Rust does fix real memory issues.
So you prefer closed-source code to potentially unsafe open-source code?
Take the recent rsync vulnerabilities for example.
Already fixed, in software that's existed for years and is used by millions. But Oh no, memory issues, let's rewrite that in <language of the month>! will surely result in a better outcome.
-
Mainly memory safety;
split(which is also used for other programs likesort) had a memory heap overflow issue last year to name one.
The GNU Coreutils are well tested and very well written, the entire suite of programs has a CVE only once every few years from what I can see, but they do exist and most of those would be solved with a memory and type safe language.That said, Rust also handles parallelism and concurrency much better than C ever could, though most of these programs don't really benefit from that or not much since they already handled this quite well, especially for C programs.
but they do exist and most of those would be solved with a memory and type safe language.
Maybe.
Still, there are other sources of bugs beyond memory management.
And i'd rather have GPL-ed potentially unsafe C code to... closed-source Rust code.
-
as long as the linux kernel is still gpl.
I seem to recall some drama about rust in the kernel... what could that mean...
All the kernel Rust code is GPL, so you can leave that slippery slope alone. MIT licenced core utils just leave the door open to eventually using them in the BSDs as well.
-
I fear moving away from GPL that moving to Rust seems to bring, but Rust does fix real memory issues.
So you prefer closed-source code to potentially unsafe open-source code?
Take the recent rsync vulnerabilities for example.
Already fixed, in software that's existed for years and is used by millions. But Oh no, memory issues, let's rewrite that in <language of the month>! will surely result in a better outcome.
They're MIT licensed.
-
I would love this news if it didn't move away from the GPL.
Mass move to MIT is just empowering enshittification by greedy companies.
What does the license change actually mean? What are the differences?
-
What does the license change actually mean? What are the differences?
The code can be taken and used in close source projects
-
as long as the linux kernel is still gpl.
I seem to recall some drama about rust in the kernel... what could that mean...
That has nothing to do with anything. rust code has nothing to do with the license.
-
as long as the linux kernel is still gpl.
I seem to recall some drama about rust in the kernel... what could that mean...
Nothing. The language used has absolutely nothing to do with the license.
-
So i hear that removing all the gnu stuff opens linux to be redistributed with a bew liesinse like mit. Which means its a little more closed iff a little more monitized.
Not knowledge enough on my own to know for sure. If someone with more knowledge could explain.
The Linux kernel still is and will always be GPL. It really doesnt matter if the coreutils aren't.
-
I would love this news if it didn't move away from the GPL.
Mass move to MIT is just empowering enshittification by greedy companies.
Genuinely what negative ramifications could come of uutils being MIT licensed? The kernel license isn't going to change and I really don't see how companies can abuse uutils for a profit.
-
I fear moving away from GPL that moving to Rust seems to bring, but Rust does fix real memory issues.
So you prefer closed-source code to potentially unsafe open-source code?
Take the recent rsync vulnerabilities for example.
Already fixed, in software that's existed for years and is used by millions. But Oh no, memory issues, let's rewrite that in <language of the month>! will surely result in a better outcome.
Already fixed, in software that's existed for years and is used by millions. But Oh no, memory issues, let's rewrite that in <language of the month>! will surely result in a better outcome.
Rsync is great software, but the C language fates it to keep having memory issues in spite of its skilled developers.
Preventing a bug from being possible > fixing a bug.
-
but they do exist and most of those would be solved with a memory and type safe language.
Maybe.
Still, there are other sources of bugs beyond memory management.
And i'd rather have GPL-ed potentially unsafe C code to... closed-source Rust code.
The Rust code isn't closed source, but I'd strongly prefer a coreutils replacement to use GPL over MIT as well.
-
At first I was sceptical, but after a few thought, I came to the solution that, if uutils can do the same stuff, is/stays actively maintained and more secure/safe (like memory bugs), this is a good change.
What are your thoughts abouth this?
The correct title should be "Ubuntu explores replacing gnu utils with MIT licenced uutils".
-
The code can be taken and used in close source projects
And how does this hurt all of us who use it for open source projects?
-
And how does this hurt all of us who use it for open source projects?
Competitive improvements the company makes make be kept secret, re packaged, and sold without making contributions to the src code.
Basically embrace, extend, extinguish
-
I wonder whether Linux Mint will follow suit?
Mint is basically Ubuntu with all of Canonical's BS removed. This definitely counts as Cononical BS, so I'd be surprised if it made its way into Mint.
-
And how does this hurt all of us who use it for open source projects?
means it can also be captured by a corpo takeover and taken private
-
Unlike the other alternative coreutils, uutils focuses on GNU compatibility. If you depend on GNUisms, this allows you to unGNU & unGPLv3+ your system.
I don't understand, you'd still have to completely replace the linux kernel for a situation where this matters to occur, no?
and the linux kernel is where 99% of the work is, correct?
-
means it can also be captured by a corpo takeover and taken private
It can be forked by anyone, but what is already out there will always be there.
-
It can be forked by anyone, but what is already out there will always be there.
Until you're left with choosing between an abandoned open source version and an up to date closed source blob.
