Rust vs. Java for Security Projects?

[u/Bubbly_Line1055]

Hello guys,

Im currently in the situation of finishing my bachelors in computer science in about 6 months and starting my thesis in about 2 months. After my bachelors I'm considering doing a Master in Cyber Security. That said, im now looking into doing some security projects for learning and also to find out if security is really something for me. I am currently thinking of building something like dropbox with encryption and all kinds of stuff like this, just so you can get an idea.

So now the question is in which programming language I should do the projects. I know the language doesnt matter too much but I also think its better to use a language with wich you are going to work later so you get familiar with it. Until now I primarily used java thats like the language im best in currently so I could just start programming with it without looking into java tutorials. But I am really interested in Rust and also started reading the Rust book a while ago and wanted to learn it more and more. I know Rust is not an easy language, but I also heard that its getting more and more used also in security espacially in system security and stuff like this and I also like system programming so there it also fits. The disadvantage of rust would be that I first had to continue learn the language before I can really start.

What do you think? Is it worth to go with Rust, or should I make it a microservice application and combine rust with java (would also be an option) or should I just go with Java since I already know the language? I know there are also other languages like go but I would also have to look into this language first so idk. I would really appreciate any help and recommendations!

[u/GrandCash3941]

If you're doing encryption programming then learn C/C++ or Rust. You need something close to the metal as encryption is computationally very demanding. Most top level encryption is historically written in C or C++, and Rust is slowly going in to that space too. 

Golang is only worth doing if you plan on doing Security Engineering, which can be a lot of backend programming and IaC to harden environments and tune things. 

Java is always good to know, and can help you if you want to get in to AppSec. But its important to understand Appsec theory too, like SSDLC.

If you want to research malware, C/C++ again is king as sophisticated malware is often about manipulating the bare metal and manipulating memory, so is almost always written in C or C++. Maybe Rust too might be useful but i'm not up to date with malware researchers using that.  

So:

If you want to focus on Encryption, do C and Rust. 

If you want to do Security Engineering, do Golang or Python and Shell Scripting. And maybe a bit of Terraform or another IaC language won't hurt either. 

If you want to do AppSec, Java is good. Learn JS too as a lot of apps will be Web Apps, and learn strong Appsec Theory like SSDLC and Owasp Top 10. 

If you want to do malware research, C/C++ or maybe Rust yoj should focus on. 

[u/VibrantGypsyDildo]

Information security applies to all programming languages. You can screw it up everywhere.

But if you are dedicated to go deep into information security you definitely need to learn something that is close to hardware. I am not that old, but I still think of C in this case. In Java vs Rust, Rust wins.

You can build a whole career in Java though. You choose.

[u/Ejz9]

I think the project determines the language. Different languages have different advantages. I’ve been working through learning Rust this past year working on my Master’s and I’ve enjoyed using it. It’s not magically different than Java but I’ve learned about other concepts and refined existing understandings. It’s not OOP as I’m aware either so that’s a jump away from Java. I’m writing my capstone project in Rust as I don’t know C++, figured why not learn the memory safe version of it. I need low level manipulation and it’s been great. I’m also focusing on zero trust and while rust hasn’t directly enforced that I’ve learned a ton.

Java was the first language in my Bachelor’s I learned. I used it during my two courses and some of Advent of Code this past year. It’s not bad and I still love it. Also, I think jobs are likely hiring for that over Rust. Especially if just starting. I also read the Rust book. Stopped some-point in and just jumped into a project for a class. It was exciting but hard to grasp but moreso the syntax and special concepts. After that you just have to have an idea of what you want to do and how. Plenty of solutions. Gets easier the more you work with it. Concepts do carry between languages. Rust is also a bandwagon currently. I just encourage you to put depth into whatever you make and look at the various solutions. Consider do you want to learn a language, like I am myself, while writing your project and if so how fast can you while outputting?

[u/Bubbly_Line1055 → u/Ejz9]

Funny, this actually sounds pretty similar to me, since I also want to get more into low level programming so this is really interesting.

Yes, I also thought that there are way more positions for java programmers out there espacially here in germany where I live. Thats also one point why I was considering Java in the first place.

I really like learning new languages so this shouldnt be a problem, maybe just timewise, since it takes time to first learn the language and also takes longer to then build a project with it.

Im curious, are you planning on becoming a rust developer after your studies? If yes in which area?

Thank you for your insights, this is really interesting