Benefits and Drawbacks of Adopting a Secure Programming Language: Rust as a Case Study
Benefits and Drawbacks of Adopting a Secure Programming Language: Rust as a Case Study
复制标题
DOI：
--
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Kelsey R. Fulton;Anna Chan;Daniel Votipka;M. Hicks;Michelle L. Mazurek
中科院分区：
文献类型：
--
作者：
Kelsey R. Fulton;Anna Chan;Daniel Votipka;M. Hicks;Michelle L. Mazurek
Rust和Go等编程语言的开发是为了应对常见的和潜在的破坏性内存安全相关漏洞。但采用新的、更安全的语言可能会令人担忧和复杂。为了更好地了解采用Rust的贝内和挑战，我们对专业的，主要是高级软件开发人员进行了半结构化的采访，他们在团队中使用过Rust或试图引入Rust（n = 16），我们对Rust开发社区进行了调查（n = 178）。我们询问了参与者使用Rust的个人经历，以及在他们公司使用Rust的经历。我们发现了一系列积极的特性，包括良好的工具和文档，开发生命周期的贝内，以及整体安全编码技能的提高，以及缺点，包括陡峭的学习曲线，有限的库支持，以及对未来雇用更多Rust开发人员的能力的担忧。我们的研究结果对于促进Rust的采用以及更广泛的安全编程语言和工具具有重要意义。
Programming languages such as Rust and Go were developed to combat common and potentially devastating memory-safety-related vulnerabilities. But adoption of new, more secure languages can be fraught and complex. To better understand the benefits and challenges of adopting Rust in particular, we conducted semi-structured interviews with professional, primarily senior software developers who have worked with Rust on their teams or tried to introduce it (n = 16), and we deployed a survey to the Rust development community (n = 178). We asked participants about their personal experiences using Rust, as well as experiences using Rust at their companies. We find a range of positive features, including good tooling and documentation, benefits for the development lifecycle, and improvement of overall secure coding skills, as well as drawbacks including a steep learning curve, limited library support, and concerns about the ability to hire additional Rust developers in the future. Our results have implications for promoting the adoption of Rust specifically and secure programming languages and tools more generally.