foundation-faq-2020 VS hyperscan

You can read all about it here, a great FAQ put together when the foundation was first started.

No. As I understand it, https://github.com/rust-lang/foundation-faq-2020/blob/main/FAQ.md#q-hiring

Not quite 50/50, but from the FAQ (https://github.com/rust-lang/foundation-faq-2020/blob/main/FAQ.md#q-bylaws):

That is possible; see this FAQ for more details. But the foundation will start with small things and plans to extend its scope with time. It's unlikely that you'll notice a difference anytime soon. The foundation could potentially pay contributors for implementing features, but there are currently no plans for this.

While Rust seems like a great programming language, I have come across some criticisms of it which appear to have some validity. Comparatively more impactful than what Drew describes here is the trademark problem that's listed on Hyperbola GNU/Linux site's webpage titled Rust's Freedom Flaws: https://wiki.hyperbola.info/doku.php?id=en:main:rusts_freedo...

*Please be aware that the rust project is now independent of Mozilla, so the following is not based on the latest information available.

Rust and also Cargo (the Rust package manager) violate the freedom to redistribute without “explicit” approval. Their trademark license imposes requirements for the distribution of modified versions that make it inconvenient to exercise freedom 3. The Rust's Media Guide says it merely supplements the official Mozilla trademark policy; it doesn't replace it. Since their trademark policy applies, then everything in that list (including Rust and Cargo) pulls in the same issue as Firefox and Thunderbird.

In short, Mozilla won't be happy with us applying patches and modifications to their trademarked language without “explicit approval”, except for non-commercial usage, so it is a freedom issue. For further references, there is a report in Rust about those trademark restrictions and Niko's response (one of the members of the Rust Legal Team).

I'm not an expert in this stuff, but this sounds like it could bear some weight. Currently the problem has not been resolved and it is still a matter to be considered by the rust board. Here is the latest thread on the problem I could find on the rust-lang GitHub: https://github.com/rust-lang/foundation-faq-2020/issues/35

They have an unhelpfully generic answer to that in their FAQ: "After spending a significant amount of time researching potential umbrella organizations, we decided that our best option was to incorporate an independent entity. Rust is a technology and community that is value driven and we simply didn’t find an organization that we felt was aligned with our community goals. This does mean more work for us, especially upfront, but we think the tradeoff is worth it."

https://github.com/rust-lang/foundation-faq-2020/blob/main/F...

Maybe some other PCRE-compatible implementation offers streaming. For instance, https://www.intel.com/content/www/us/en/developer/articles/t... says it has this feature, but of course given who it's from it may be tied to a single brand of CPU.

github seems to be https://github.com/intel/hyperscan

I think of WAFs as an extra safety net. Defense in depth.

The author complained about the performance cost of WAFs in general, but not all WAFs have be structured like ModSecurity. They could for example be based on something like https://github.com/intel/hyperscan and perf is at a very different level.

Another example of old timey Unix code just breaking things in minor point releases. See https://abi-laboratory.pro/index.php?view=changelog&l=glibc&... and https://github.com/intel/hyperscan/issues/359.

It’s a bespoke scanning setup designed to deal with GitHub’s scale. Under the hood it’s using Intel’s hyperscan as the regex engine.

https://github.com/intel/hyperscan

Hyperscan is an Intel regular expression library.

We are using hyperscan [3] instead of grepping byte sequences with Python, which is orders of magnitudes faster. It can also handle 4Gb+ files because of this which binwalk cannot.

It's used for a year now in production and it's way more precise and faster than binwalk. We are getting less false-positives too, and even if unblob fails to extract everything, we still get meaningful information out of firmwares, where binwalk just failed with no output previously.

[1]: https://github.com/onekey-sec/unblob/blob/main/unblob/handle...

[2]: https://github.com/onekey-sec/unblob/blob/main/unblob/proces...

[3]: https://github.com/intel/hyperscan