3 ms·

> This seems a bit counter-intuitive given that serious problems are still being found years or even decades later. Perhaps battle-tested is insufficient. Bugs

> This seems a bit counter-intuitive given that serious problems are still being found years or even decades later. Perhaps battle-tested is insufficient. Bugs will always exist. But that statement will apply equally to any software, regardless of language. > New code can take advantage of the battle-tested nature of the original code even if it's in a different language. That's why I referenced the Peter Naur paper on Programming as Theory Building---in practice, that may very well not be the case.

dikaiosune 11y ago
> Bugs will always exist. But that statement will apply equally to any software, regardless of language. I'd be curious to see some research suggesting that the prevalence and severity of those bugs is identical regardless of development tool/language/runtime, but I'd be surprised if that's demonstrable. The question at hand is not "will safer languages eliminate all bugs?" It's "will safer languages reduce the prevalence and severity of important classes of bugs?" I'd wager it's probably yes, but even if you disagree, I don't think that it's reasonable to suggest that because there will always be bugs we should never improve.
- mikegerwitz 11y ago
  > I'd be curious to see some research suggesting that the prevalence and severity of those bugs is identical regardless of development tool/language/runtime, but I'd be surprised if that's demonstrable. I intended to convey that software written in any language will have bugs, not that all languages will produce the same types of bugs.
  - Manishearth 11y ago
    Yes, but all that gets you is that no language is a panacea; bugs always exist. It does not address the question of whether or not there will be a propensity for more bugs (or more severe bugs) when comparing two languages.
    - mikegerwitz 11y ago
      > It does not address the question of whether or not there will be a propensity for more bugs (or more severe bugs) when comparing two languages. My argument is based on the act of rewriting it---regardless of language. Many languages provide excellent guarantees, but that does not protect against bugs in the implementation itself (logic).
      - Manishearth 11y ago
        Yes; and the rewrite can take into account the logic used in the old code (especially in the security-critical areas) as well as all the vulnerabilities that have happened before. You're not starting from a complete blank slate; you can pick up the lessons learned. Despite being "battle tested", all of these C programs continue to have both memory and logic errors. I think a rewrite would have the same rate of new logic issues after the initial code review and testing. "bugs will always exist" -- sure, so if we have something that eliminates a class of bugs, why not use it? The other classes of bugs will be there (and probably in the same force) whether you rewrite or not. A lot of these bugs get introduced due to cruft in old code as well. So there are a bunch of tradeoffs here.
      - pcwalton 11y ago
        > Many languages provide excellent guarantees, but that does not protect against bugs in the implementation itself (logic). This is the black and white security fallacy. Memory safety problems are, statistically, a huge quantity of security bugs. By eliminating them you drastically reduce the number of bugs.

dikaiosune 11y ago

> Bugs will always exist. But that statement will apply equally to any software, regardless of language. I'd be curious to see some research suggesting that the prevalence and severity of those bugs is identical regardless of development tool/language/runtime, but I'd be surprised if that's demonstrable. The question at hand is not "will safer languages eliminate all bugs?" It's "will safer languages reduce the prevalence and severity of important classes of bugs?" I'd wager it's probably yes, but even if you disagree, I don't think that it's reasonable to suggest that because there will always be bugs we should never improve.

mikegerwitz 11y ago
> I'd be curious to see some research suggesting that the prevalence and severity of those bugs is identical regardless of development tool/language/runtime, but I'd be surprised if that's demonstrable. I intended to convey that software written in any language will have bugs, not that all languages will produce the same types of bugs.
- Manishearth 11y ago
  Yes, but all that gets you is that no language is a panacea; bugs always exist. It does not address the question of whether or not there will be a propensity for more bugs (or more severe bugs) when comparing two languages.
  - mikegerwitz 11y ago
    > It does not address the question of whether or not there will be a propensity for more bugs (or more severe bugs) when comparing two languages. My argument is based on the act of rewriting it---regardless of language. Many languages provide excellent guarantees, but that does not protect against bugs in the implementation itself (logic).
    - Manishearth 11y ago
      Yes; and the rewrite can take into account the logic used in the old code (especially in the security-critical areas) as well as all the vulnerabilities that have happened before. You're not starting from a complete blank slate; you can pick up the lessons learned. Despite being "battle tested", all of these C programs continue to have both memory and logic errors. I think a rewrite would have the same rate of new logic issues after the initial code review and testing. "bugs will always exist" -- sure, so if we have something that eliminates a class of bugs, why not use it? The other classes of bugs will be there (and probably in the same force) whether you rewrite or not. A lot of these bugs get introduced due to cruft in old code as well. So there are a bunch of tradeoffs here.
    - pcwalton 11y ago
      > Many languages provide excellent guarantees, but that does not protect against bugs in the implementation itself (logic). This is the black and white security fallacy. Memory safety problems are, statistically, a huge quantity of security bugs. By eliminating them you drastically reduce the number of bugs.