5 ms·

The software has apparently been written in C++, it all sounds like a bit of a farce. EDIT: to clarify the above comment, the context is the use of C++ and main

by willtim 11y ago

The software has apparently been written in C++, it all sounds like a bit of a farce. EDIT: to clarify the above comment, the context is the use of C++ and mainstream tools for 8 million lines of safety critical code.

duaneb 11y ago
You can write safe C++ (although it's hard). You can write extremely buggy haskell or ada. Are you really that much of a language bigot you can't see past the damn language to provide any interesting conversation?
- hluska 11y ago
  Your comment would be stronger and you'd make the exact same point if you removed the entire last sentence. That level of aggression has no place here.
- PeCaN 11y ago
  Speaking from experience, it's a hell of a lot easier to write buggy C++ than buggy Haskell or Ada (both of which can in some cases be formally verified to follow the spec). C++ is unsafe by default and you have to write lots extra checks to make sure your code is bulletproof. Ada is safe by default and you have to be verbose to do powerful-but-dangerous things with pointers. While yes, you can write secure and fault-tolerant code in any language and insecure and buggy code in any language, the sheer amount of C and C++ software that has been demonstrated to be insecure and very buggy in recent years raises some questions about whether that's the tool we want to use. Languages are tools. C is a $5 wrench with a blade for a handle. Ada is a pocketknife where you can pull out the wrench or blade if you need it. Both of them can do the same things, but with one you have to be very, very careful to not cut yourself.
  - sqeaky 10y ago
    > C++ is unsafe by default and you have to write lots extra checks to make sure your code is bulletproof No you don't, just use RAII and you cover almost all the safety issues. Put all memory allocations, file openings, mutex locking and other resource acquisition in constructors and the matching cleanup in deconstructors and it becomes very safe. Now, not only is memory cleaned up and exception safe, but several classes of file handling and multi-threading issues are categorically fixed. There are a few other rules to enhance this to the point of preposterous safety, but with just this technique I see fewer memory leaks than I do with some garbage collected languages. The big safety issues occur when people take the unplanned style of treating C++ as if it were C with Classes. Something that exacerbates this is a plethora of bad training material (mostly old from before C++03) and even university classes that use manual memory allocations outside a constructor (naked new statments), exceptions and manual memory releasing in exception unsafe ways. I am sure Ada can be used incorrectly, now imagine if in an old standard not all Ada compilers supported the same language features. Imagine the subset of common features was dangerous as hell. Imagine creating a memory structure like a linked list because only some compilers provided one prewritten and some are implementations were missing core language features. However, all the compilers ship with dangerous tools to build it wrong. This was C++ in 1995, and many people who learned it then never unlearned their mistakes. C++03 laid down a bunch of technical fixes and a minimum benchmark for decent compilers. It could have been used safely with what I described above, but much of the developer community was change averse. Now with C++11 we are changing and really cool things are happening because the developers are treating it like a different language.
  - nickpsecurity 11y ago
    The pocketknife is a pretty good analogy. Like that one.
  - duaneb 11y ago
    Sure. None of this is news to anyone. Why not discuss why C++ was chosen in the first place?
    - Jtsummers 11y ago
      Ability to hire people to fill the role of programmer.
      - tremon 10y ago
        That sounds like they were looking to scrape the bottom of the barrel. If programmer salary played a key role for such a critical piece of software, they have bigger problems.
        PeCaN 10y ago
        From what I understand from this thread, it's worse than that: The problem wasn't programmer salary, it was that their budget was so big that they wanted to hire extra people and could not find enough Ada programmers. Yup. It got written in C++ because they wanted to spend more money and there are more experienced C++ developers than Ada developers.
  - snuxoll 11y ago
    I mean, if you stick with the stack and avoid pointer manipulations C++ can be pretty damned safe. Still, there's a reason Ada is typically used for things like flight control systems....
  - tome 10y ago
    > Haskell or Ada (both of which can in some cases be formally verified to follow the spec) Haskell doesn't even have a spec
    - PeCaN 10y ago
      Sorry, I was referring to the spec for the program, not the spec for the language. And Haskell does actually have a spec[1], but almost everyone uses GHC extensions so I suppose that's kind of moot. 1. https://wiki.haskell.org/Language_and_library_specification https://wiki.haskell.org/Language_and_library_specification
  - planteen 10y ago
    Is Haskell suitable for real-time software?
    - tome 10y ago
      No, not least because it's garbage collected. It may be useful for writing a DSL in which to write real-time software though: http://ivorylang.org/tower-overview.html http://ivorylang.org/tower-overview.html
- willtim 11y ago
  C++ is not a safe language. Ada has many more safety features. What is very interesting to me and perhaps others is why C++ was chosen, despite being (IMHO) unsuitable for such applications. I am not a language bigot because I would use the right tool for the job. What would you use?
  - duaneb 11y ago
    I would probably use Ada as well. However, calling out C++ is like blaming the gun for an accidental suicide. Yea, the gun may have been faulty, but why was it in that position in the first place? Terrible management with way too much funding.
    - willtim 10y ago
      Choosing C++ is certainly a red flag in this context, which is why I pointed it out.
- koenigdavidmj 11y ago
  This is a government development project. Do you really think they're getting the C++11 features that make writing C++ half-pleasant? It's more likely that some PM tried to define a "sane subset of C++", with templates explicitly banned. Now they can't use STL containers or unique_ptr, and they're basically writing C with classes.
  - duaneb 11y ago
    NASA basically uses the approach you patronize so easily. And while I'm not arguing that it's practical to take this approach, defensive coding techniques allow reliable code to be written in environments that wouldn't be considered safe today... like the Apollo Guidance Computer. So yea, I don't consider it useful to finger C++ when there were clearly many poor decisions made at all levels of the engineering stack.
    - willtim 10y ago
      The Apollo Guidance computer wasn't anywhere near the scale and complexity of the F35 software. I'm also fairly certain the Apollo mission did not pick their technologies based on "programmer availability".
      - engi_nerd 10y ago
        I wish the source for "programmer availability" hadn't evaporated into the ether, because I'd love to see it. I wonder if it meant "The guys who know Ada are all furiously writing F-22 software" -- parenthetical aside, the F-22 was in flight testing and development during the same years that the F-35 project was getting underway, so there would have been high demand for people experienced with developing mission critical flight software -- "and therefore we have to go with the guys we can spare, who mostly know C++ or Java or something". Or did they mean "No one coming out of school knows Ada anymore so let's go with a more widely known language"?
        willtim 10y ago
        Are you predicting that the next US fighter after F35 will be powered by Python? Because that's what US institutions like MIT now teach.
NegativeLatency 11y ago
I thought that was pretty standard for such projects, or are you saying it's normally in C or Ada?
- willtim 10y ago
  It's usually Ada.
sharpy 11y ago
It was probably largely written by Ada programmers transitioning to C++, along with people with prior C++ experience but with no/little experience writing mission critical software.
- Jtsummers 11y ago
  I'll be an asshole. Defense contractors hire Electrical Engineers straight out of college and throw them at programming tasks. They hire Computer Scientists straight out of college and throw them at testing tasks. Of the two, the CS graduates (still woefully underexperienced) should be doing the programming, but not the design work. Instead you have EEs with 0-3 programming courses under their belt doing it. You end up with software like what I saw in my defense contractor days, where fucking BUBBLE SORT was used on an embedded system to sort 100 items. Not that long, really, but in the worst case it's 5050 iterations of a loop. These same "programmers" insist on minimizing function calls because the overhead of function calls is clearly where the hotspots are. EDIT: But yeah, the major issue (regardless of their preference for engineers over computer scientists) is a general lack of experience in the people they hire [for the domain].

by willtim 11y ago

duaneb 11y ago

You can write safe C++ (although it's hard). You can write extremely buggy haskell or ada. Are you really that much of a language bigot you can't see past the damn language to provide any interesting conversation?

hluska 11y ago
Your comment would be stronger and you'd make the exact same point if you removed the entire last sentence. That level of aggression has no place here.
PeCaN 11y ago
Speaking from experience, it's a hell of a lot easier to write buggy C++ than buggy Haskell or Ada (both of which can in some cases be formally verified to follow the spec). C++ is unsafe by default and you have to write lots extra checks to make sure your code is bulletproof. Ada is safe by default and you have to be verbose to do powerful-but-dangerous things with pointers. While yes, you can write secure and fault-tolerant code in any language and insecure and buggy code in any language, the sheer amount of C and C++ software that has been demonstrated to be insecure and very buggy in recent years raises some questions about whether that's the tool we want to use. Languages are tools. C is a $5 wrench with a blade for a handle. Ada is a pocketknife where you can pull out the wrench or blade if you need it. Both of them can do the same things, but with one you have to be very, very careful to not cut yourself.
- sqeaky 10y ago
  > C++ is unsafe by default and you have to write lots extra checks to make sure your code is bulletproof No you don't, just use RAII and you cover almost all the safety issues. Put all memory allocations, file openings, mutex locking and other resource acquisition in constructors and the matching cleanup in deconstructors and it becomes very safe. Now, not only is memory cleaned up and exception safe, but several classes of file handling and multi-threading issues are categorically fixed. There are a few other rules to enhance this to the point of preposterous safety, but with just this technique I see fewer memory leaks than I do with some garbage collected languages. The big safety issues occur when people take the unplanned style of treating C++ as if it were C with Classes. Something that exacerbates this is a plethora of bad training material (mostly old from before C++03) and even university classes that use manual memory allocations outside a constructor (naked new statments), exceptions and manual memory releasing in exception unsafe ways. I am sure Ada can be used incorrectly, now imagine if in an old standard not all Ada compilers supported the same language features. Imagine the subset of common features was dangerous as hell. Imagine creating a memory structure like a linked list because only some compilers provided one prewritten and some are implementations were missing core language features. However, all the compilers ship with dangerous tools to build it wrong. This was C++ in 1995, and many people who learned it then never unlearned their mistakes. C++03 laid down a bunch of technical fixes and a minimum benchmark for decent compilers. It could have been used safely with what I described above, but much of the developer community was change averse. Now with C++11 we are changing and really cool things are happening because the developers are treating it like a different language.
- nickpsecurity 11y ago
  The pocketknife is a pretty good analogy. Like that one.
- duaneb 11y ago
  Sure. None of this is news to anyone. Why not discuss why C++ was chosen in the first place?
  - Jtsummers 11y ago
    Ability to hire people to fill the role of programmer.
    - tremon 10y ago
      That sounds like they were looking to scrape the bottom of the barrel. If programmer salary played a key role for such a critical piece of software, they have bigger problems.
      - PeCaN 10y ago
        From what I understand from this thread, it's worse than that: The problem wasn't programmer salary, it was that their budget was so big that they wanted to hire extra people and could not find enough Ada programmers. Yup. It got written in C++ because they wanted to spend more money and there are more experienced C++ developers than Ada developers.
- snuxoll 11y ago
  I mean, if you stick with the stack and avoid pointer manipulations C++ can be pretty damned safe. Still, there's a reason Ada is typically used for things like flight control systems....
- tome 10y ago
  > Haskell or Ada (both of which can in some cases be formally verified to follow the spec) Haskell doesn't even have a spec
  - PeCaN 10y ago
    Sorry, I was referring to the spec for the program, not the spec for the language. And Haskell does actually have a spec[1], but almost everyone uses GHC extensions so I suppose that's kind of moot. 1. https://wiki.haskell.org/Language_and_library_specification https://wiki.haskell.org/Language_and_library_specification
- planteen 10y ago
  Is Haskell suitable for real-time software?
  - tome 10y ago
    No, not least because it's garbage collected. It may be useful for writing a DSL in which to write real-time software though: http://ivorylang.org/tower-overview.html http://ivorylang.org/tower-overview.html
willtim 11y ago
C++ is not a safe language. Ada has many more safety features. What is very interesting to me and perhaps others is why C++ was chosen, despite being (IMHO) unsuitable for such applications. I am not a language bigot because I would use the right tool for the job. What would you use?
- duaneb 11y ago
  I would probably use Ada as well. However, calling out C++ is like blaming the gun for an accidental suicide. Yea, the gun may have been faulty, but why was it in that position in the first place? Terrible management with way too much funding.
  - willtim 10y ago
    Choosing C++ is certainly a red flag in this context, which is why I pointed it out.
koenigdavidmj 11y ago
This is a government development project. Do you really think they're getting the C++11 features that make writing C++ half-pleasant? It's more likely that some PM tried to define a "sane subset of C++", with templates explicitly banned. Now they can't use STL containers or unique_ptr, and they're basically writing C with classes.
- duaneb 11y ago
  NASA basically uses the approach you patronize so easily. And while I'm not arguing that it's practical to take this approach, defensive coding techniques allow reliable code to be written in environments that wouldn't be considered safe today... like the Apollo Guidance Computer. So yea, I don't consider it useful to finger C++ when there were clearly many poor decisions made at all levels of the engineering stack.
  - willtim 10y ago
    The Apollo Guidance computer wasn't anywhere near the scale and complexity of the F35 software. I'm also fairly certain the Apollo mission did not pick their technologies based on "programmer availability".
    - engi_nerd 10y ago
      I wish the source for "programmer availability" hadn't evaporated into the ether, because I'd love to see it. I wonder if it meant "The guys who know Ada are all furiously writing F-22 software" -- parenthetical aside, the F-22 was in flight testing and development during the same years that the F-35 project was getting underway, so there would have been high demand for people experienced with developing mission critical flight software -- "and therefore we have to go with the guys we can spare, who mostly know C++ or Java or something". Or did they mean "No one coming out of school knows Ada anymore so let's go with a more widely known language"?
      - willtim 10y ago
        Are you predicting that the next US fighter after F35 will be powered by Python? Because that's what US institutions like MIT now teach.

NegativeLatency 11y ago

I thought that was pretty standard for such projects, or are you saying it's normally in C or Ada?

willtim 10y ago
It's usually Ada.

sharpy 11y ago

It was probably largely written by Ada programmers transitioning to C++, along with people with prior C++ experience but with no/little experience writing mission critical software.

Jtsummers 11y ago
I'll be an asshole. Defense contractors hire Electrical Engineers straight out of college and throw them at programming tasks. They hire Computer Scientists straight out of college and throw them at testing tasks. Of the two, the CS graduates (still woefully underexperienced) should be doing the programming, but not the design work. Instead you have EEs with 0-3 programming courses under their belt doing it. You end up with software like what I saw in my defense contractor days, where fucking BUBBLE SORT was used on an embedded system to sort 100 items. Not that long, really, but in the worst case it's 5050 iterations of a loop. These same "programmers" insist on minimizing function calls because the overhead of function calls is clearly where the hotspots are. EDIT: But yeah, the major issue (regardless of their preference for engineers over computer scientists) is a general lack of experience in the people they hire [for the domain].