3 ms·

It scales, and you don't have to use NASA-like process. The article fairly clearly says that making this work is a learned skill. And it is. If course it's pos

It scales, and you don't have to use NASA-like process. The article fairly clearly says that making this work is a learned skill. And it is. If course it's possible to write stuff using manual memory management in a manner such that it's nearly impossible to do well. Doctor, doctor, it hurts when I do that... I wrote a 'C' based thing around 2012 that: - is about 50,000 lines; 50ish by 1000ish lines. - uses no dynamic memory. - does very "dynamic memory" things. Each type/shape/class has its own statically allocated 'C' array of structs that is declared to worst-case, and has a "new". Behind the "new" is a lot of behavior, including pointing to other such things/objects. A set of "delete" operations would be also relatively easy. But because it's an array and it is in 'C', this is relatively little code. Yes, there is duplication involved but the object creation code is probably 20% of the total thing and each object creation is darn near provably correct. It's built on RAII principles ( perhaps foolishly, since there's no deletion ). Dependencies between objects are completely explicit in the code. Object creation must be in the correct order to manage dependencies The magic happens because scripts* are used to create all things, once at startup. it also helps because by its very nature, the system is fully serialized - after a creation script, the state of the tables of objects can be written to a text file. *scripts are, in this case nothing but sequences of verbs which send text files full of XML to a service at a TCP port. It could have been JSON or attribute-value pairs, but instead it's XML. I do take extra care to make a very comprehensive test suite or it. but since the allocation scheme is 1) cheap and 2) fully exposed as state in the system, there's nothing actually opaque about it. I don't have to do "trust falls" with a garbage collector or even the heap. You can't have a malloc() or new() failure - it'll violate a constraint and quit/exit(). You then make the table larger. From the frame of reference of the other objects, it's abstracted and opaque - after the initial setup. From the "scripting" interface, it's fully transparent.

pcwalton 11y ago
I'm willing to believe you always write flawless C. I've never seen a large C or C++ codebase written by a large team that didn't have serious memory management problems.
- ArkyBeagle 11y ago
  I know. And it's stupid to think I always write flawless 'C'. I just know how; doesn't mean it's always correct. I just smell a lot of despair in these threads.
nickpsecurity 11y ago
I've seen this post many times under different names for the authors and projects. Later on, a CVE or bug report shows up with the project's name but a different author. Because the person who created the code just couldn't break their own code like someone else who wasn't mentally attached to it. What you're likely a victim of is the Dunning-Kruger effect or Schneier's Law depending on which you prefer: https://www.schneier.com/blog/archives/2011/04/schneiers_law.html https://www.schneier.com/blog/archives/2011/04/schneiers_law... On the other hand, you could've in fact designed something as good as you claimed. In that case, I seriously suggest you publish your methods in full for peer review as they could save millions spent by the likes of NASA, seL4 project, and so on. Any method that might hit full correctness with just basic coding or whatever is a potential game-changer. Very exciting stuff.
- ArkyBeagle 11y ago
  Dunning-Kruger is a very distinct possibility :) Your handle includes the word "security"; I don't claim any powers that way beyond "don't allow memory overwrites" and "airgapping good." I doubt anybody is remotely interested in this - the problem domains are pretty boring and highly constrained. These tend to be realtime embedded ( both soft and hard realtime ). It seems wildly inappropriate for gaming, graphics or Web stuff. Perhaps I'm wrong there; not really all that clued in. There is much less to this than you might imagine. The problem is that a book is a team effort, and I have no idea who to bother with it. Not asking for a volunteer here. For an idea of the basic philosophy, it might be worth looking at Bruce Powell Douglass.
  - nickpsecurity 11y ago
    "Dunning-Kruger is a very distinct possibility :) Your handle includes the word "security"; I don't claim any powers that way beyond "don't allow memory overwrites" and "airgapping good."" There's just so many ways that language can get you I have a doubt even a handful of methods would cover them all. It takes Work to get anywhere. Best of luck to you on that. "For an idea of the basic philosophy, it might be worth looking at Bruce Powell Douglass." Appreciate the reference. Can't recall if he's in my collection or not. I'll look into his work. :)

pcwalton 11y ago

I'm willing to believe you always write flawless C. I've never seen a large C or C++ codebase written by a large team that didn't have serious memory management problems.

ArkyBeagle 11y ago
I know. And it's stupid to think I always write flawless 'C'. I just know how; doesn't mean it's always correct. I just smell a lot of despair in these threads.

nickpsecurity 11y ago

I've seen this post many times under different names for the authors and projects. Later on, a CVE or bug report shows up with the project's name but a different author. Because the person who created the code just couldn't break their own code like someone else who wasn't mentally attached to it. What you're likely a victim of is the Dunning-Kruger effect or Schneier's Law depending on which you prefer: https://www.schneier.com/blog/archives/2011/04/schneiers_law.html https://www.schneier.com/blog/archives/2011/04/schneiers_law... On the other hand, you could've in fact designed something as good as you claimed. In that case, I seriously suggest you publish your methods in full for peer review as they could save millions spent by the likes of NASA, seL4 project, and so on. Any method that might hit full correctness with just basic coding or whatever is a potential game-changer. Very exciting stuff.

ArkyBeagle 11y ago
Dunning-Kruger is a very distinct possibility :) Your handle includes the word "security"; I don't claim any powers that way beyond "don't allow memory overwrites" and "airgapping good." I doubt anybody is remotely interested in this - the problem domains are pretty boring and highly constrained. These tend to be realtime embedded ( both soft and hard realtime ). It seems wildly inappropriate for gaming, graphics or Web stuff. Perhaps I'm wrong there; not really all that clued in. There is much less to this than you might imagine. The problem is that a book is a team effort, and I have no idea who to bother with it. Not asking for a volunteer here. For an idea of the basic philosophy, it might be worth looking at Bruce Powell Douglass.
- nickpsecurity 11y ago
  "Dunning-Kruger is a very distinct possibility :) Your handle includes the word "security"; I don't claim any powers that way beyond "don't allow memory overwrites" and "airgapping good."" There's just so many ways that language can get you I have a doubt even a handful of methods would cover them all. It takes Work to get anywhere. Best of luck to you on that. "For an idea of the basic philosophy, it might be worth looking at Bruce Powell Douglass." Appreciate the reference. Can't recall if he's in my collection or not. I'll look into his work. :)