Sandra Höltervennhoff, Leibniz University Hannover; Philip Klostermeyer and Noah Wöhler, CISPA Helmholtz Center for Information Security; Yasemin Acar, Paderborn University, George Washington University; Sascha Fahl, CISPA Helmholtz Center for Information Security
Modern software development still struggles with memory safety issues as a significant source of security bugs. The Rust programming language addresses memory safety and provides further security features. However, Rust offers developers the ability to opt out of some of these guarantees using unsafe Rust. Previous work found that the source of many security vulnerabilities is unsafe Rust.
In this paper, we are the first to see behind the curtain and investigate developers' motivations for, experiences with, and risk assessment of using unsafe Rust in depth. Therefore, we conducted 26 semi-structured interviews with experienced Rust developers. We find that developers aim to use unsafe Rust sparingly and with caution. However, we also identify common misconceptions and tooling fatigue that can lead to security issues, find that security policies for using unsafe Rust are widely missing and that participants underestimate the security risks of using unsafe Rust.
We conclude our work by discussing the findings and recommendations for making the future use of unsafe Rust more secure.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.
author = {Sandra H{\"o}ltervennhoff and Philip Klostermeyer and Noah W{\"o}hler and Yasemin Acar and Sascha Fahl},
title = {{{\textquotedblleft}I} wouldn{\textquoteright}t want my unsafe code to run my {pacemaker{\textquotedblright}}: An Interview Study on the Use, Comprehension, and Perceived Risks of Unsafe Rust},
booktitle = {32nd USENIX Security Symposium (USENIX Security 23)},
year = {2023},
isbn = {978-1-939133-37-3},
address = {Anaheim, CA},
pages = {2509--2525},
url = {https://www.usenix.org/conference/usenixsecurity23/presentation/holtervennhoff},
publisher = {USENIX Association},
month = aug
}
