2016 Underhanded Rust contest: the results | Hacker News Reader

2016 Underhanded Rust contest: the results

blog.community.rs

86 pointssteveklabnik17 comments

Interesting that the winning submission exploits a known bug: https://github.com/rust-lang/rust/issues/38899. Underhanded C submissions don't need to exploit bugs; the C language already has plenty of loopholes!

Organizer here!

Aidan actually submitted two entries. This particular entry that exploited this unsoundness bug wasn't actually the winner, even though it was great (horrible?). We weren't sure if the underhandedness would survive code review in this particular instance. He had to jump through some hoops [1] to trigger the unsoundness.

His other entry blew us away. It took us a long time to figure out how it worked.

[1]: https://github.com/rust-community/underhanded-submissions/bl...

That other entry is probably the most creative exploit of a language package management ecosystem I've ever seen.

Oops, thanks for the correction!

(That was one of the runners up, not the winning one.)

Oddly, the source code doesn't show up with JavaScript disabled.

Isn't delivering text precisely what HTML is supposed to be so good at? Should a web page about underhanded programs work even without JavaScript enabled?

Drat, that must be the jekyll syntax highlighter. It might be easier then reading it off of github if you or anyone else has problems with reading the post:

https://github.com/rust-community/blog.community.rs/blob/gh-...

Hey, thanks for the nice reply, and sorry for being a bit peevish.

They didn't show up at all in iOS Safari.

It works fine for me.

This really lacks the concise magic of the C obfuscated/underhanded contests, its a lot easier to hide crazy behaviour amongst one of dozens of files and library imports...

+1. The reason only 4 people submitted is that the challenge seems so, well, intimidating. Not hard intimidating, but "I wouldn't be able to think up & code a decent entry in a few minutes" intimidating. Nobody really wants to make a whole toy payment processing system like this, just to come up with one underhanded bug. It also comes with a lot of tooling: with underhanded rust, it is very clear that this is a project, with multiple files, cargo, dependencies, etc. All of the underhanded C contests are single-file, often single- or two-function solutions.

I think that's a huge jump to a conclusion.

Far more likely is that Rust is niche, and fluency sufficient to produce something underhanded is exceedingly rare for that same reason.

C, on the other hand, has been around for decades and is used by an order of magnitude (or two) more developers.

It's simply not a fair comparison, and it's decidedly fanboyish to conclude otherwise.

Be careful not to jump to conclusions as well. :) Even given that Rust is newer (as well as hopefully harder to exploit!) it's entirely fair to criticize the contest rules for being a bit intimidating, and doesn't imply fanboyishness or anti-Rust sentiment. I think it was an interesting experiment to try crafting a more "real-world" underhanded challenge in contrast to the highly artificial underhanded C contest, especially since this is the first such contest and the organizers weren't sure if they were going to get a flood of responses or a trickle. But personally, for future iterations of this contest I'd suggest something more freeform to encourage more submissions (which is ultimately better for the security of the language, after all!).

Haha, in that respect, it's a terrific argument for the language, I suppose.

I had to check if Go's path.Join() does the same thing with joining to an absolute path (luckily for me, it doesn't).

I can see that being a useful feature for implementing e.g. `cd`, though.

IIRC, Python's `os.path.join` behaves the same way if you join with an absolute path.

Reply on news.ycombinator.com