Josh Aas, Executive Director at ISRG, talks about Prossimo, an ISRG project focused on moving critical software to Rust. They discuss Let's Encrypt, building a secure digital infrastructure, transitioning from C to Rust for improved memory safety, and the ambition to make the Linux kernel memory-safe with Rust.
The Let's Encrypt project has significantly improved online security by providing free and accessible SSL certificates to millions of websites.
The Prossimo project aims to enhance internet security by transitioning critical software infrastructure from C to Rust, a memory-safe language, to eliminate memory safety vulnerabilities and protect against cyber threats.
Deep dives
ISRG and Let's Encrypt
The podcast episode discusses the Internet Security Research Group (ISRG) and their project Let's Encrypt, a certificate authority that aims to provide free and easy-to-use SSL certificates. Let's Encrypt has played a significant role in increasing the percentage of website encryption, with around 350 million websites currently using their certificates. The episode highlights the importance of making certificates accessible and the impact of Let's Encrypt on improving online security.
Privacy-Preserving Metrics
Another project discussed in the podcast is DiviUp, a privacy-respecting metrics service. DiviUp allows organizations to collect data about their software and users while protecting user privacy. By using a mechanism that splits and encrypts data, DiviUp allows organizations to derive aggregate insights without compromising user privacy. The episode emphasizes the significance of metrics in improving products and highlights the need for privacy-focused approaches in data collection.
Prust About and Memory Safety
The podcast delves into another project under the ISRG umbrella called Prust About, which focuses on making critical software infrastructure memory-safe. The goal is to move away from using C and C++ programming languages, known for their lack of safety, and utilize safer options like Rust. By rewriting important components with memory-safe languages, the project aims to eliminate memory safety vulnerabilities, which make up a significant percentage of software bugs. The episode emphasizes the importance of addressing memory safety to enhance consumer safety and protect against cyber threats.
Challenges and Ambitions
The podcast explores the challenges and ambitions of the ISRG initiatives. It highlights the difficulty of introducing language changes and obtaining buy-in from maintainers and the broader community. Despite the challenges, the podcast emphasizes the importance of investing in memory-safe software and the potential for long-term benefits. The episode also discusses the ambitious goal of making Rust a widely adopted language for critical software components, leveraging partnerships, performance considerations, and API compatibility to drive adoption.
Rustacean Station is a community project; get in touch with us if you’d like to suggest an idea for an episode or offer your services as a host or audio editor!
[@00:00] - Meet Josh Aas - Executive Director at ISRG (Internet Security Research Group), a non-profit dedicated to building a more secure and privacy-respecting digital infrastructure.
[@01:32] - Let’s Encrypt Project - a nonprofit Certificate Authority providing TLS certificates to 363 million websites.
[@06:53] - Divvi Up project - a privacy-respecting system for aggregate statistics.
[@09:48] - Prossimo - ensuring memory safety for the internet’s most critical infrastructure.
[@15:24] - Discussion about Curl and Rust.
[@19:06] - The benefits of rewriting software, particularly transitioning from C to Rust for improved memory safety.
[@34:19] - The ISRG’s ambition to make the Linux kernel memory-safe with Rust.
[@37:27] - Can Zig potentially be a competitor to Rust?