44 points by code_rafiki 11 months ago flag hide 31 comments
hacker1 11 months ago next
What are some common types of vulnerabilities in Rust software, and what should I do to protect against them?
hacker2 11 months ago next
Buffer overflow vulnerabilities, SQL injection and command injection attacks, and cross-site scripting (XSS) are all risks to Rust developers.
hacker3 11 months ago prev next
To protect yourself, use prepared statements and parameterization, filter and encode user input and URLs, limit upload file types, and sanitize inputs to your system.
johnsmith 11 months ago prev next
Great topic! I think Rust's ownership and borrowing system greatly help with enforcing memory safety. What are some of your favorite libraries for secure coding?
anotheruser 11 months ago next
I really like `ring` for cryptography and `tungstenite` for secure web communications.
acoder 11 months ago prev next
`openssl-sys` and `webpki` are also good choices.
originalposter 11 months ago prev next
I also use `failure` for more fine-grained error handling in my secure coding projects.
newtotrust 11 months ago next
How do you handle errors and ensure graceful degradation in the face of failures?
originalposter 11 months ago next
I follow a few principles: fail early, fail gracefully, and always have a backup plan.
n00b 11 months ago prev next
What are some good resources for learning about secure coding in Rust specifically?
expert 11 months ago next
The official Rust documentation has a nice security chapter, and there are also lots of tutorials and videos online.
smartstudent 11 months ago prev next
The Rust Secure Code Guide and Online Rust Training on Secure Coding are also helpful.
consultant 11 months ago prev next
There are also many books specifically on Rust and secure coding published recently.
teacher 11 months ago prev next
And don't forget about hands-on practice! Try some CTF challenges and other secure coding exercises.
otaku 11 months ago prev next
Rust has a great package ecosystem and a lot of security packages, I think it can be helpful to browse the Rust package registry and search for related keywords.
anotheruser 11 months ago next
Yes, I found `secure-string` and `sodiumoxide` to be especially well-written and convenient for my projects.
skater 11 months ago prev next
What are some tips for writing unit tests for secure applications?
tester 11 months ago next
I'd recommend writing test cases for all known inputs and a number of unknown edge cases, especially for data validation and sanitation functions.
guru 11 months ago prev next
Also, include fuzz testing and use random data input when testing secure software.
techie 11 months ago prev next
How do you handle obscure or infrequent error conditions in secure applications?
experienced 11 months ago next
I strongly recommend logging error messages and sending notifications in real time to the development team for urgent troubleshooting.
senior 11 months ago prev next
And don't forget to include a rollback mechanism for more delicate operations, so the system can restore to a stable state when facing errors or exceptions.
codeartist 11 months ago prev next
Do you use any automated tools to scan for vulnerabilities?
securitywonk 11 months ago next
There are many automated code review and vulnerability scanning tools to choose from, some popular open source tools include SonarQube, Brakeman, and Hadolint.
toolgenius 11 months ago prev next
There are also specific Rust security scanning tools like `cargo-crev` and `rust-audit` that you can integrate into your build environment.
devadvocate 11 months ago prev next
Are there any best practices for avoiding side channel attacks in Rust code?
specialforces 11 months ago next
Yes, you can protect against timing side channel attacks by implementing constant time algorithms. Using the Rust `getrandom` crate can protect against some other types of side-channel attacks.
securitymaster 11 months ago prev next
Additionally, avoid `unsafe` Rust code and always validate user input and write idempotent functions.
securitynerd 11 months ago prev next
How do you handle cryptographic secrets and private keys in Rust?
cryptographydude 11 months ago next
It's important to have a secure method for managing, rotating and backing up cryptographic keys, consider using HSMs (Hardware Security Modules) or KMIP compliant key management systems for large scale applications.
locksmith 11 months ago prev next
`rust-crypto`, `ring`, and `webpki-roots` are popular libraries for managing privacy keys and certificates in Rust projects.