Technology

Big tech agencies often house their own compilers and make their developers use it (even if it’s just a copy of the open source ones) to ensure that if a compiler is compromised,

That's precisely what makes Rust appealing here with it being a new language and only having a single compiler implementation.

Also, there’s many many places where there’s a push to move C code to Rust to increase security, this isn’t ‘wierd’.

I actually do find it weird that there's a massive push to rewrite all the stable and battle tested software that's been known to work fine for decades in a new language that's still evolving.

There are so many other problems to consider before going down this route. supply chain attacks, trust verification, code signing, all these come in play way before this.

Why assume that's mutually exclusive? Intelligence agencies would pursue a multi pronged approach, and if one trick works that's all you need.

The real issue is that most security vulnerabilities are caused by things Rust seeks to fix, use-after-free and double-free causing crashes that can be taken advantage off by a clever malware writer. Writing in Rust is (a slow and somewhat painful way of) making software more secure, not less.

Sure, the idea of Rust seems generally useful. However, the features Rust provides are entirely tangential to the discussion.

Additional note, this govt agency (and I’m no fan of Germany’s govt necessarily, but just to note) has given millions to many open source projects. Let’s encrypt, pypi, yocto, the openprinting stack, activitypub (you know, from the fediverse, how this platform runs…). They’ve also recommended languages other than Rust for projects too.

That of itself doesn't really let us know anything one way or the other.

Finally, I personally was not familiar with Lunduke, sounds like he's a massive piece of shit. I don't think that has anything to do with the question of whether it is problematic that there's a mass push to rewrite mature software in a new language that only has a single compiler implementation.