A year of Rust and DNS
Love the idea of reimplementing DNS in Rust. Would love to see more efforts like this so that we have secure-by-design language implementation of core security services.<p>But BIND isn&#x27;t just failing because &quot;it&#x27;s written in C&quot;, it&#x27;s failing because it&#x27;s written in terrible C. That said, &quot;terrible C&quot; is probably most every C routine written by someone with less than 10 years of <i>solid</i> low level experience, so &quot;writing good C code&quot; is not very scalable. There <i>are</i> active, solid projects with very few security exploits that are written entirely in C. Nginx comes to mind.<p>The article makes a brief reference to DJBDNS, which is written in C, but has suffered zero security exploits [1], and is extremely performant. And it <i>is</i> being used in production, so presumably if it had any exploits they would have been exposed by now.<p>But...DJB&#x27;s code is (usually?) released under a rather unfriendly (though mostly open) license, and DJBDNS hasn&#x27;t been updated in some time, so a more modern project isn&#x27;t a bad idea. And Rust developers can probably write solid code with only a few years of programming experience, which makes it easier to extend without adding security holes on a weekly basis (coughBINDcoughOPENSSLcough)...<p>[1] <a href="http:&#x2F;&#x2F;cr.yp.to&#x2F;djbdns&#x2F;guarantee.html" rel="nofollow">http:&#x2F;&#x2F;cr.yp.to&#x2F;djbdns&#x2F;guarantee.html</a>