Course Description
Our core software stacks are built upon unsafe language (e.g. C/C++). However, with the progress of safe languages, such as Rust and Go, industries are rewriting legacy codes to make our systems safer. In this course, students will learn about security concerns related to unsafe language and then teach about secure programming with one of the fastest-growing safe languages. For example, Rust and Go are ranked top in the 2020 developer survey by Stack Overflow.
Athena Title
Secure Programming
Semester Course Offered
Not offered on a regular basis.
Grading System
A - F (Traditional)
Course Objectives
The course materials are designed to teach students how vulnerable codes are introduced in unsafe languages and how they can be avoided with a safe language. Besides lectures on security issues with unsafe language and teaching Rust language, students will be assigned two projects and three papers. In their first project, students will write a system application in the unsafe language (i.e., C/C++) and later peer-review each other's software to report vulnerabilities. In their second project, students will write the same system application using Rust and also peer-review later. Finally, both projects will be judged based on their bug reports and efficacy. Students will also be assigned three different papers from three different categories: Rust language, Rust security features, and Rust based OS. Students will present their selected paper and will be scored upon their depth of understanding.
Topical Outline
I. System Programming. A. System call. B. File I/O. C. Network I/O. D. Concurrency. II. Software Vulnerabilities. A. Buffer overflow. B. Integer overflow. C. Use after free and double free. D. Synchronization bugs and race conditions. E. Type confusion. III. Basic Rust Language. A. Ownership and lifetimes. B. Arrays and strings. C. Control flow and error handling. D. Crates and modules. E. Structure and enums. IV. Rust Abstractions. A. Generics. B. Traits. V. Rust Tools. A. Iterators. B. Closures. VI. The Practice of Rust. A. Cells and Rc. B. Collections. C. I/O. VII. Advanced Rust. A. Concurrency. B. Unsafe code. VIII. Rust Security. A. Memory management. B. Control-flow protection. C. Type safety. IX. Rust OS. A. RedOx. B. RustOS.