Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Somebody is going to make billions on an AI that can transpile vulnerable code into Rust.

Unacceptable to have so much non provably safe code exploitable like this.



DARPA is doing something similar to this with their TRACTOR work.

https://www.darpa.mil/program/translating-all-c-to-rust


transpile to rust with the original vulnerabilities intact?


It will depend on use case. Remember that adage. Make it work, make it right, make it fast (in that order).

So first pass yes. Then you make refactor and see if tests are green. Rinse and repeat.


Obviously not. With enough resources, engineers could do it, and it’s a constrained enough problem that AI likely could do so as well eventually.


the purpose of having engineers write software is that they can transparently prove that it works reliably, and they can be professionally held accountable and learn if it fails.

You're suggesting that reliability should be improved by being obfuscating the code through transpilation or by merit of being generated by a black box (LLM).

I really suspect that simply transpiling code to rust or ada or some other "safe" language largely wouldn't improve its security. The whole point of these "safe" languages is that they encourage safer practices by design, and that in porting the code to rust you have to restructure the program to conform to the new practices (as opposed to just directly re-implementing it).

I haven't seen a LLM that is reliably capable of logic/reasoning or can even reliably answer technical questions, much less synthesize source code that isn't some trivial modification of something it has been trained on. And it's not clear that future models will necessarily be capable of doing that.


I don’t understand. Is it possible to mathematically prove that a codebase written in rust has no vulnerabilities or something?


Think they are referring to use after free (UAF) behavior. Safe Rust doesn't allow UAF.

You can violate Rust invariants using bugs in compiler.


No, but you can transpile (incredibly trivial) Rust programs into Coq that can be than formally verified to give a defined output for all possible inputs.


No idea what this is about but sounds like a test with extra steps


Test all the steps. All possible steps.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: