5 ms·

It seems like small, custom systems like these without memory protection should at least use a safe language like Rust.

tosseraccount 11y ago
The first "stable" version of the Rust, version 1.0.0, was released in May 2015 - wikipedia. Seems like Rust needs a few more laps around the track. ( Rust is from Mozilla Foundation, perhaps we can see some alternate implementations of their products to see how reliable they are with Rust ).
- bluejekyll 11y ago
  And it's seen 6 minor releases since then. Probably more stable than this kernel.
SeanDav 11y ago
C can be very safe or very unsafe, it just depends on how you use it. As a counter point: critical code for missions to Mars are written in C. http://www.verticalsysadmin.com/making_robust_software/ http://www.verticalsysadmin.com/making_robust_software/
- obelisk_ 11y ago
  Just because expert C programmers were able to make it work doesn't mean that C is the best way to write secure code. I say this as someone who writes quite a bit of C (though I don't view myself an expert in it yet).
  - SeanDav 11y ago
    I highly doubt they just drew C out of a hat and decided to make it work for their multi million dollar, "absolutely-cannot-fail-software". They would have considered other languages out there. C was the winner.
    - nickpsecurity 11y ago
      Speaking from high-assurance niche, C absolutely sucked for that in more ways than you can imagine. Like the recent NASA post, the reason they use C is tooling and available talent. Ridiculous amounts of manpower went into developing static analysis, testing, compilers, etc for C. The best talent in high assurance pretty much all know C, too, whether or not it's their default language. Almost all the hardware supports it, too. So, a combo of top talent w/ a C history and tons of tooling made most of them go with C. Many others went with Ada/SPARK. A few small fish even use typed or structured assembler. C is only chosen due to tooling and "better the devil you know" philosophy. Work on superior languages got more results with less effort in both human and mechanical reviews, though. So, the inferior language is only used due to an accident of history. Details on that here: http://pastebin.com/UAQaWuWG http://pastebin.com/UAQaWuWG
      - pekk 11y ago
        Are you recommending that people switch to Ada, or Pascal, or what? Your pastebin seems to strongly favor Algol-likes. It would be nice to see some more substantive reasons why people should be using an Algol-like language in 2016. Just saying that C was originally hacked together to be expedient doesn't quite make that case.
        nickpsecurity 11y ago
        There's a number of HLL's to choose from today with less safety issues. Start with an efficient one. If developing languages or compilers, then put effort into one that has a nice foundation instead of C. Similarly, there's prior work on C-like languages that had enhanced safety (Cyclone, Ivory) and tools like Softbound+CETS that automatically make code safe w/ a penalty. Use or invest effort in such tools. And finally, if nothing else is available, use a subset of C with sensible coding style and throw every bug-finding tool you can at it. Those are the recommendations in that order. What you use depends on your domain, constraints, skills, and so on. Modula-2, Active Oberon, Modula-3, Free Pascal, and Component Pascal were probably closest to C's domain in terms of safe, efficient, easy-to-compile languages. Ada is systematic in all the errors it handles but with steep, learning curve. SPARK straight up proves your code. One can also use DSL's/4GL's that generate proper C w/ automated checks like iMatix and Galois do (and I once did). I've also seen Ocaml and LISP used for real-time, even embedded, systems with custom runtime. Ocaml was also used for tooling w/ source to object code verification. So, there's a number of options. Each are behind C currently in tooling due to limited uptake and investment. More uptake and investment can fix that. Even so, average results of those tools have far lower defects than C code with shorter time to train people (ignoring Ada). That most teams aren't composed of geniuses in safe coding means that's important too.
- pcwalton 11y ago
  Because NASA spends 10x the resources to develop and verify that software. If you are willing to spend that much, any language can be secure.
zem 11y ago
you might find this interesting: https://github.com/fpiot/arduino-ats https://github.com/fpiot/arduino-ats

The first "stable" version of the Rust, version 1.0.0, was released in May 2015 - wikipedia. Seems like Rust needs a few more laps around the track. ( Rust is from Mozilla Foundation, perhaps we can see some alternate implementations of their products to see how reliable they are with Rust ).

bluejekyll 11y ago
And it's seen 6 minor releases since then. Probably more stable than this kernel.

SeanDav 11y ago

C can be very safe or very unsafe, it just depends on how you use it. As a counter point: critical code for missions to Mars are written in C. http://www.verticalsysadmin.com/making_robust_software/ http://www.verticalsysadmin.com/making_robust_software/

obelisk_ 11y ago
Just because expert C programmers were able to make it work doesn't mean that C is the best way to write secure code. I say this as someone who writes quite a bit of C (though I don't view myself an expert in it yet).
- SeanDav 11y ago
  I highly doubt they just drew C out of a hat and decided to make it work for their multi million dollar, "absolutely-cannot-fail-software". They would have considered other languages out there. C was the winner.
  - nickpsecurity 11y ago
    Speaking from high-assurance niche, C absolutely sucked for that in more ways than you can imagine. Like the recent NASA post, the reason they use C is tooling and available talent. Ridiculous amounts of manpower went into developing static analysis, testing, compilers, etc for C. The best talent in high assurance pretty much all know C, too, whether or not it's their default language. Almost all the hardware supports it, too. So, a combo of top talent w/ a C history and tons of tooling made most of them go with C. Many others went with Ada/SPARK. A few small fish even use typed or structured assembler. C is only chosen due to tooling and "better the devil you know" philosophy. Work on superior languages got more results with less effort in both human and mechanical reviews, though. So, the inferior language is only used due to an accident of history. Details on that here: http://pastebin.com/UAQaWuWG http://pastebin.com/UAQaWuWG
    - pekk 11y ago
      Are you recommending that people switch to Ada, or Pascal, or what? Your pastebin seems to strongly favor Algol-likes. It would be nice to see some more substantive reasons why people should be using an Algol-like language in 2016. Just saying that C was originally hacked together to be expedient doesn't quite make that case.
      - nickpsecurity 11y ago
        There's a number of HLL's to choose from today with less safety issues. Start with an efficient one. If developing languages or compilers, then put effort into one that has a nice foundation instead of C. Similarly, there's prior work on C-like languages that had enhanced safety (Cyclone, Ivory) and tools like Softbound+CETS that automatically make code safe w/ a penalty. Use or invest effort in such tools. And finally, if nothing else is available, use a subset of C with sensible coding style and throw every bug-finding tool you can at it. Those are the recommendations in that order. What you use depends on your domain, constraints, skills, and so on. Modula-2, Active Oberon, Modula-3, Free Pascal, and Component Pascal were probably closest to C's domain in terms of safe, efficient, easy-to-compile languages. Ada is systematic in all the errors it handles but with steep, learning curve. SPARK straight up proves your code. One can also use DSL's/4GL's that generate proper C w/ automated checks like iMatix and Galois do (and I once did). I've also seen Ocaml and LISP used for real-time, even embedded, systems with custom runtime. Ocaml was also used for tooling w/ source to object code verification. So, there's a number of options. Each are behind C currently in tooling due to limited uptake and investment. More uptake and investment can fix that. Even so, average results of those tools have far lower defects than C code with shorter time to train people (ignoring Ada). That most teams aren't composed of geniuses in safe coding means that's important too.
pcwalton 11y ago
Because NASA spends 10x the resources to develop and verify that software. If you are willing to spend that much, any language can be secure.

zem 11y ago

you might find this interesting: https://github.com/fpiot/arduino-ats https://github.com/fpiot/arduino-ats