New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
RustFS is now Generally Available
TL;DR: RustFS 1.0.0 GA is now generally available. Written in Rust and released under the Apache 2.0 license, RustFS has grown from its first commit in February 2024 into a distributed object storage platform with 32,000+ GitHub stars and 2.7 million+ instances deployed worldwide. The core object storage engine is stable and ready for production.
Read the full story here: https://rustfs.com/blog/announcing-rustfs-1-0-0-ga/
Is anyone else self-hosting RustFS here? I am hosting one with @host_c as stor backend. (sorry for the tag if it's annoying, mate)
Comments
Not me
LMFAO
im using rustfs in prod lol
Didn't they have loads of security issues?
🤝
Fancy shedding us some light? T_T
https://app.opencve.io/cve/?vendor=rustfs
33 CVEs found
😭😭😭😭
LOL. Rust is annoying because when compiling, it need like 128GB of ram
ROFLMAO!
Those are some pretty high CVSS scores.
Let me guess, it's mostly vibe-coded?
Yes, big surprise there was a lot of CVEs in alpha, beta and rc releases in version ≤ 1. /s
Assigning weight to security flaws in software that hasn't been released for production yet is simply too stupid. Especially when, as in this case, the core maintainers explicitly warned against using the software for critical production workloads throughout its early lifecycle.
What you should look for are security flaws in versions ≥ 1.0.0 GA. (not alpha, beta, or rc releases).
If any of you (most likely not) or others find many, then you can rant about it, but what you are doing right now, is just plain stupid.
You know we're not allowed to use stuff these days unless it has been vibe coded.
Last time I tried out RustFS, the first 2 log lines were Claude debugging lines that were somehow left on the build.
I forgot to update my setup after posting this; doing now.
very impressed with rustfs, how long till they will enshitify the foss version?
Pointing out that a lot of the CVEs have a high CVSS is stupid? Perhaps you're reading more into what I'm saying than I actually am. I'm not saying the project is shit, or that people should avoid using it. I'm not saying it's dead in the water or that I could do better. I was just commenting that, even for a project in alpha, that's a lot of CVEs. Nothing more.
https://app.opencve.io/cve/?q=vendor:minio
Looks like they have roughly the same number of CVEs, although RustFS accumulated it in less than a year, whereas MinIO took two years. MinIO having a lower rate of CVE issuance doesn't mean it's more secure, of course.
https://app.opencve.io/cve/CVE-2026-62378
Stored XSS vulns in 2026? lol.
Either it's been heavily vibe coded or the developers need a quick web security 101 course
You should be using this
Pour it everywhere, don't spare any. Buy more.
The problem isn't Rust, the problem is programmers vibe-coding shit and thinking that memory safety will somehow protect them from the entire suite of other problems that no programming language protects against.
Rust is the problem, it promises you things it will never be able to deliver.
Rust will only get you into more trouble, it is the ultimate footgun.
And stop blaming the victims, those gullible programmers are victims not perpetrators. Blame the true villains who are selling rust lies to those poor souls.
Just look at the OpenBSD guys, are they using rust? They don't give a shit about it because they know better.
When you're in doubt about security look at OpenBSD, see what they are doing. And follow!
It only promises memory safety and freedom from undefined behavior. It's a narrow but important subset of bugs that are more relevant to parsers and operating system kernels than to web apps.
https://isopenbsdsecu.re/about/
So some guy got some rejections, became upset and reacted poorly huh. Big deal.
And that link is so good that said guy never bothered to update it. That's so funny, NOT!
You should know better
OpenBSD faces severe scrutiny despite its low user base and no other system scores better.
Yeah the game of pointing at who is doing better is fun boys
Anyways thanks for the input from @stable_genius and also @forest
"That link" is pretty much universally accepted by exploit developers.
It's also surprisingly fair. It lists all their mitigations and gives an honest (but sometimes brutal) assessment. Where the mitigation actually does something useful, they give props for it (e.g.
atexit()hardening). But others likefret-cleanare just stupid. It's as good as GCC's (dead and useless "baby's first defeat-ROP-without-CFI")-mmitigate-roplmao.tl;dr great privsep and isolation design, decent-to-mediocre-to-terrible exploit mitigation in the kernel.
Oh, and give fuzzing OpenBSD's syscalls a try. You'll shit your pants.
Recognize any of those? Anyone who's deep into exploit dev will recognize at least a few of those.
With that said, I don't hate OpenBSD. I actually like it a lot.
But to hold it up as a pinnacle of exploit mitigations in C is risible.
lowendcluster when?