Blog
Tech blog on web, security & embedded
Select topic
Select allIoTadvanced-UIsalgorithmsautomotivecc++data-compressiondata-engineeringdevelopmentdevopseducationembeddedenergygointeropirmajavajavascriptkotlinluameet-the-teammeetupmemory-safetymicroservicesntpd-rsopen-dataopen-sourcependulumprivacypythonreactresearchrustsecuritystatimestm32technologytimingtoolstypescriptweb-developmentwhy-rust
April 23, 2025
Does using Rust really make your software safer?
We keep saying that Rust is how we make software safer. In this blog, we'll tackle a real-world vulnerability, 'rewrite it in Rust', and show you the results of our empirical research, both as a high-level overview and a tech deep-dive.
I'm fascinated by the creative use of SIMD instructions. When you first learn about SIMD, it is clear that doing more multiplications in a single instruction is useful for speeding up matrix multiplication. But how can all of these weird instructions be used to solve problems that aren't just arithmetic?
March 11, 2025
Translating bzip2 with c2rust
Over the past couple of months we've been hard at work on libbzip2-rs, a 100% Rust drop-in compatible implementation the bzip2 compression and decompression functionality.
For this project, we used c2rust for the initial translation from the C code to a Rust implementation. The generated Rust code has now been cleaned up and made safe where possible. This post describes our experiences using c2rust for this project.
February 25, 2025
zlib-rs is faster than C
February 10, 2025
Mix in Rust with Java (or Kotlin!)
Java is one of the most commonly used programming languages that we have not yet discussed in our Rust Interop Guide. In this article, we will discuss three different methods to call Rust code from Java: JNI, JNR-FFI and Project Panama. We will show the differences between these methods and we will do some basic benchmarking to compare their performance. These methods not only work for Java but also for other JVM languages like Kotlin. Here we will mainly focus on Java, but Kotlin examples are available in the Kotlin branch of our GitHub repository.
January 24, 2025
OpenLEADR 3.0: Initial Traction and Future Plans
Last November, we announced that our open-source Rust implementation of the latest version of the Open Automated Demand Response (OpenADR) standard had officially joined the Linux Energy Foundation’s OpenLEADR project. Today, we’re excited to share some of the early traction we’re seeing, outline our future plans, and invite your support in shaping what’s next.
January 21, 2025
The hunt for error -22
This article is a linear retrospective of how we searched for and eventually fixed a hard-to-find bug in our embedded software. If you're only interested in the outcome, then make sure to read the last three sections.
December 18, 2024
Power consumption of an experimental webserver
This article was authored by Jordy Aaldering and Folkert de Vries
Over the past couple of months, we teamed up with Bernard van Gastel and Jordy Aaldering at Radboud University's Software Energy Lab to measure nea's energy efficiency.
December 6, 2024
Travelling to the land of the rising sun with Statime
At the beginning of October, David and I went to ISPCS in Tokyo. The ISPCS (IEEE Symposium on Precision Clock Synchronization) is all about the PTP protocol and related technologies, and we attended because of Statime, our Rust implementation of the Precision Time Protocol.
November 25, 2024
Manipulating time through (S)NTP
The NTP protocol is used by many devices to synchronize their system clocks. However, many devices use SNTP clients (Simple NTP) which are even more vulnerable to interference. As most (S)NTP packets are unauthenticated, they are vulnerable to spoofing, making it possible to change a device's time by manipulating (S)NTP packets.
In this blog, we discuss how (S)NTP packets can be forged to manipulate a device's system clock. Especially on the default SNTP client for many Linux systems, this turned out to be very easy. We will also dicuss the consequences of such attacks, as well as how these attacks can be prevented.
November 13, 2024
Rust implementation of OpenADR 3.0 becomes part of OpenLEADR
OpenLEADR development is ramping up again with a new Rust implementation of OpenADR 3.0 becoming part of the OpenLEADR project.
November 12, 2024
Rust needs an official specification
Can we currently reason about Rust code with absolute certainty? Not really, but we should be able to. In this article, we dive into the reasons why it may be time for a Rust specification.
October 30, 2024
Enabling pools in NTS
We previously talked about how secure time is required for a safe internet. We mentioned how we want to increase the adoption of NTS, the secure time synchronization standard built on top of NTP. For this, we proposed to develop a public NTS pool. In this article, we expand on what pooling is, and what is required to enable an NTS pool.
October 7, 2024
Rust is rolling off the Volvo assembly line
In my job I get to speak to lots of people about Rust. Some are just starting out, some have barely ever heard of it, and then some people are running Rust silently in production at a very large company in a very serious product.
Our Statime project now provides strong synchronization performance and accurate synchronization error estimates without manual tuning for any specific hardware, because it automatically determines the main uncertainty parameters for a Kalman-based clock servo. This process is described in a scientific paper, soon to be published by the IEEE.
September 30, 2024
Rust interop in practice: speaking Python and Javascript
September 17, 2024
Mix in Rust with C++
This article will help you to slowly introduce some Rust into your C++ project. We'll familiarize ourselves with the tooling and go through some examples.
August 27, 2024
Mix in Rust with Python: PyO3
In this article, we'll dive into combining Rust with Python. Specifically, this post covers calling modules written in Rust from Python scripts.
August 26, 2024
Current zlib-rs performance
Our
zlib-rs project implements a drop-in replacement for libz.so, a dynamic library that is widely used to perform gzip (de)compression.July 15, 2024
Mix in C with Rust: A taste of C in your Rust
Can't wait to learn how to call C code from your Rust project after reading my previous posts about Rust interop in general and calling Rust from C? Good! If you haven't read those yet, please do, because I'm going to assume you have in this article. We've seen the basics of Rust's FFI, and have experimented with calling Rust from C. Going the other way around, you'll walk into much the same challenges.
The other day I came across Diplomat, an opinionated tool that makes a lot of choices for you. If you've read my previous post in this series, you'll have seen that that can be quite valuable. If you haven't read the previous article yet, do so before continuing to read this one, as it'll help you appreciate the concepts in this post, and it introduces the example as well.
July 8, 2024
Statime vs Linux PTP: Comparison of precision
As part of the development of our Precision Time Protocol implementation, Statime, we want to know how it performs compared to other implementations of PTP.
To figure this out, last April we visited VSL, the Dutch National Metrology Institute. There, we performed comparitive precision tests between Statime and Linux PTP.
June 24, 2024
Will Rust be alive in 10 years?
Will Rust still exist, and have proper support, 10, 20 or even 30 years from now? We’ve been asked this question multiple times in the last year. It is a fair question, as adopting any new technology requires an investment and comes with uncertainties, one of them being the durability of the technology. This article explains why we expect Rust to stand the test of time.
June 18, 2024
Want more Rust? Break the cycle!
Let's be frank: Rust is a cool language, but there's not a chance I'm introducing it in my company if I can't get any engineers for it. We'll stick with technologies with a much healthier job market.
June 10, 2024
Tock binary size
Tock is a powerful and secure embedded operating system. While Tock was designed with resource constraints in mind, years of additional features, generalizing to more platforms, and security improvements have brought resource, and in particular, code size bloat.
June 7, 2024
Authentication for PTP
PTP was originally designed for networks in which all devices were ultimately trusted. In version 1, no security mechanism was present, and version 2 only provided an experimental mechanism. However, with version 2.1 of the PTP standard (IEEE 1588-2019) there is now a normative security mechanism in section 16.14.
June 7, 2024
Mix in Rust with C
So, you've just read my previous post on Rust interoperability in general, and now you're curious about how to actually apply the concepts to your situation. You've come to the right place, because in this post and the two that follow, I'll demonstrate how to make Rust and C talk to each other.
June 6, 2024
Mix in Rust
What does it actually mean to introduce Rust in an existing project, and having it communicate with other languages in the code base? This article launches a series of blog posts that provide guidance for introducing Rust into your code base step by step.
May 24, 2024
A safe Internet requires secure time
The internet has a hole at the bottom of its trust stack, and we need to do something about it. In particular, the internet needs secure time synchronization to fortify the security of our digital world. In this article, we present a path towards the adoption of securely synchronized time.
May 14, 2024
Hacking time: how you can control anyone's clock
Messing around with people's clocks can be a great source of practical jokes. Even nowadays, with many people getting their time digitally, this is not as impossible as you might think. (And the month of April, with the switch to summer time and April Fool's Day, provided the perfect timing for this experiment, of course...)
April 15, 2024
Save the planet, code in Rust
The number of data centers worldwide is constantly increasing, and so is their electricity consumption. One way to become more power-efficient is certainly the constant development of better hardware, but we as developers should do our share. This post shows how coding in Rust can help to use existing resources more efficiently, to help preserve our planet — at least a little bit.
March 7, 2024
Sudo-rs dependencies: when less is better
When sudo-rs development started, we added several dependencies using Rust’s crates ecosystem to quickly ramp up development. During development we accrued approximately 135 transitive (direct and indirect) dependencies. Once this was identified, we managed to reduce our total dependencies down to three. In this blog, we explain why and how we did this.
March 1, 2024
“Software must become safer”, but how?
Our tagline reads “Software must become safer”, and for good reason; We feel very strongly about this. But it does lead to the obvious and fair question: “What exactly do you do to ensure that the software your teams produce is safe and secure?”
February 28, 2024
Teach-rs: Rust 101 evolved
At the end of 2022, we announced the creation of Rust 101, a university course that introduces students of computer science to Rust. Initially, the course was created for the Faculty of Informatics and Information Technologies at STU Bratislava (FIIT), but from the start we've wanted to create an open-source, modular and reusable set of teaching resources. Having now achieved that milestone, it is time for a new announcement: Rust 101 has evolved to teach-rs.
February 26, 2024
Rust in Production at Tweede golf (podcast)
In February of 2024, I was invited by Matthias Endler of Corrode to join him on his podcast Rust in Production. We discussed how Tweede golf uses Rust in production, to ensure the safety and security of critical infrastructure software.
February 20, 2024
Sequential-storage: efficiently store data in flash
While using a full-blown filesystem for storing your data in non-volatile memory is common practice, those filesystems are often too big, not to mention annoying to use, for the things I want to do. My solution?
I've been hard at work creating the sequential-storage crate. In this blog post I'd like to go over what it is, why I created it and what it does.
February 14, 2024
Building an Async Runtime with mio
Asynchronous programming is pretty weird. While it is straightforward enough to understand in principle (write code that looks synchronous, but may be run concurrently yada yada yada), it is not so obvious how and when async functions actually perform work. This blog aims to shed light on how that works in Rust.
February 6, 2024
Rust for hardware vendors
At Tweede golf we're big fans of creating applications on embedded devices with Rust and we've written a lot about it.
But if you're a hardware vendor (be it chips or full devices/systems), should you give your users Rust support in addition to your C support?
In this blog I argue that the answer to the question is yes.
December 19, 2023
Introducing ntpd-rs metrics
In Dutch we have a saying 'meten is weten', which translates to 'to measure is to know'. That sentiment is frequently overlooked in setting up computers and networks.
December 18, 2023
An unusual tool for unused code
Ever wanted to have a quickly put together command-line tool to delete large chunks of your project automatically? Me neither, but my colleague Marc made a pretty convincing argument as to why such a tool could be useful. So we went ahead and made it. Here are the results.
December 8, 2023
Implementing NTPv5 in ntpd-rs
At Tweede golf, we are working on modern implementations of time synchronization protocols in Project Pendulum. The ntpd-rs project is part of it, and we've recently implementend the draft specification of NTPv5, for which we built a test server at IETF 118. This blogs covers the what, why and how (including a 'how to run').
November 29, 2023
Pendulum long-term goals: usability and security (video)
I was invited by OCP-TAP to join them in their 87th Project Call to talk about Pendulum, our Rust implementations of NTP and PTP. The recording of this call on 8 Nov 2023 is now available.
November 20, 2023
ntpd-rs: Folkert explains the project (video)
At the GOSIM Conference in Shanghai, last September, I had the opportunity to talk about ntpd-rs, our project implementing the Network Time Protocol.
November 8, 2023
Statime continues: Boundary Clocks and Master Ports
About one year ago, Tweede Golf announced "Statime", a Rust implementation of the Precision Time Protocol (PTP). The result of that first phase was a working proof of concept. Quite a bit has changed since then.
November 6, 2023
sudo-rs' first security audit
Thanks to funding from NLNet and ISRG, the sudo-rs team was able to request an audit from Radically Open Security (ROS). In this post, we'll share the findings of the audit and our response to those findings.
November 1, 2023
Why we sponsor memory safety event Tectonics
One of the hot topics in software security is memory safety. This article covers two questions: What is it? And why do we think it is worth investing in?
October 30, 2023
Dealing with Dependencies in Rust
At Tweede golf we are convinced that if software is written in Rust, it will be more robust (compared to legacy languages such as C, C++ or Java), and more efficient (compared to code written in PHP or Python and again, Java).
In order to get more robust software out there, we have to get Rust code running on computers of people who are not themselves Rust developers.
October 17, 2023
First stable release of ntpd-rs
We're proud to announce that 5 October 2023 marked the first stable release of ntpd-rs!
September 12, 2023
Our pixel-rendered planner with a Rust backend
Just because we're engineers, doesn´t mean we build ALL our applications ourselves. But sometimes inspiration hits and good things happen. So our company planner is now canvas-rendered, has a Rust backend and works like a charm.
September 5, 2023
Are we embedded yet?
Rust is maturing and every year more software is being made with it. In fact, Rust can be used as a competitor to C. In this article I will argue that this is now also the case for embedded Rust!
August 21, 2023
Rust 101's first run at STU Bratislava
When we first introduced Rust 101 to you on our website, preparations for its first run where in full swing. The action started in February 2023; 20 students of the Faculty of Informatics and Information Technologies of the Slovak University of Technology in Bratislava followed 9 lectures and 9 tutorials, and worked on their own rust project to round off the course. The course was completed in May.
August 10, 2023
Sovereign Tech Fund invests in Pendulum
Sovereign Tech Fund will support our effort to build modern and memory-safe implementations of the Network Time Protocol (NTP) and the Precision Time Protocol (PTP).
A while ago, in 2020, I wrote a blog post similar to this one. Sure, it has a bit of a clickbait-y title, but it couldn't be more accurate. At the time I was full of amazement about the way Rust tackles embedded software development. I forsaw great things for Rust's future, even though Rust and its ecosystem were yet not quite mature. We're 3 years further down the road right now, which is like 300 Rust years as Rust is progressing fast. About time for an update!
June 30, 2023
Our talk at CYSAT 2023
In April 2023 Wouter (left in picture) and I and went to Paris to attend CYSAT, a conference about cyber security for the space industry. We met up with our client GAMA's Chris de Claverie (right in picture). Wouter and Chris (and also Dion) had been working together for months and teamed up to explain to the audience how and why they were putting Rust in space.
June 21, 2023
Report: NTP security audit
In March/April 2023 ntpd-rs underwent a security audit. The audit was executed by Radically Open Security and funded by NLnet Foundation. The audit did not uncover any major issues, but did help us make ntpd-rs more robust. It has been extremely valuable to have someone from outside of the development team look at the code in detail.
May 31, 2023
Threat Modelling
Since I joined Tweede golf as the security lead, I’ve had the chance to work on improvements regarding security and privacy for all projects, as well as for the organisation in general.
May 30, 2023
ntpd-rs: NTP for the modern era (video)
At RustNL 2023, a Rust conference held in Amsterdam recently, I had the opportunity to talk about ntpd-rs, our project implementing the Network Time Protocol.
For some time, we have been quietly laying the groundwork for a new implementation of sudo in Rust. Now we are excited to talk about it!
This article is an adaptation of the original, published by Prossimo.
We're happy to announce that the Internet Security Research Group has officially made us the maintainers of the open-source memory-safe implementation of NTP, ntpd-rs. As such, we are now also looking for early adopters.
The implementation includes a server and client, as well as full support for Network Time Security (NTS), which brings encryption and greater integrity to time synchronization. Timing is precise and stable, as reflected by excellent performance in the NTP pool.