High Assurance Rust

Practices from High Assurance Rust (Tiemoko Ndogga) for software you can justifiably trust — enough evidence to back confidence in functionality and security. Goal: minimize vulnerabilities and make attacks impractical, not "impossible". Complements rust-conventions, dev-testing, power-rust; this skill is about the assurance layer above "it compiles".

Core framing

• Bug vs. vulnerability — a vulnerability is a bug an attacker can exploit. "Can't log in with valid creds" is a bug; "can log in with invalid creds" is a vulnerability. Assurance targets both robustness (no bugs) and security (no exploitable bugs).
• Assurance = level of confidence, built by layering tools/processes. Three categories, applied together:
  • Static — checks on code without running it (compiler, types, lints, model checking).
  • Dynamic — checks by running it (tests, fuzzing, sanitizers, benchmarks).
  • Operational — measures while it runs in production (hardening, isolation, monitoring).
• No single tool finds all bugs. Map work onto the static/dynamic × known/unknown quadrant: signature scanners (e.g. cargo-audit) catch known bugs; fuzzing/verification probe unknown ones. Verification can prove the absence of a class of bugs (no false negatives for that class) but the class is limited. Combine techniques; assume residual risk.
• Lean lightweight. Prefer fast, repeatable techniques that ship quality code faster over heavyweight process. Bias toward development speed, escalate rigor where the threat justifies it.

Threat modeling (do this first, shift-left)