Iddqd, or the hardest kind of unsafe Rust

oxide.computer

30 pointshasheddan4 comments

The section on how to do software assurance of unsafe code in Rust is excellent.

A lot of prior guidance I've seen tends to stop at the level of running Miri, but (as the article says) there are things Miri won't catch. The model-based tests with a known-good oracle and the use of fault injection (especially panic-related behavior) are really good.

Safety in the face of panics in Rust can be hard to reason about, and the standard library itself has made errors with those semantics in the past.

Great work Rain and Oxide for building something so useful and assuring it so robustly!

Thanks Andrew! Honestly I learned so much about what makes unsafe Rust so hard from building iddqd.

Hi Rain, have you considered fuzzing? and if not, why?

(Thanks for cargo-nextest btw!)

Since iddqd works on structured data, the model-based tests (while not being coverage-guided) do a lot of the kinds of things fuzzing would do against an algorithm which accepted unstructured data. In principle the bitstream from which structured data is generated could be provided by a fuzzer rather than the system RNG, but proptest makes that somewhat inconvenient. It's possible the newer Hegel library makes that easier, though.

(You're welcome!)

Reply on news.ycombinator.com