4 ms·

Speaking from experience, it's a hell of a lot easier to write buggy C++ than buggy Haskell or Ada (both of which can in some cases be formally verified to foll

by PeCaN 11y ago

Speaking from experience, it's a hell of a lot easier to write buggy C++ than buggy Haskell or Ada (both of which can in some cases be formally verified to follow the spec). C++ is unsafe by default and you have to write lots extra checks to make sure your code is bulletproof. Ada is safe by default and you have to be verbose to do powerful-but-dangerous things with pointers. While yes, you can write secure and fault-tolerant code in any language and insecure and buggy code in any language, the sheer amount of C and C++ software that has been demonstrated to be insecure and very buggy in recent years raises some questions about whether that's the tool we want to use. Languages are tools. C is a $5 wrench with a blade for a handle. Ada is a pocketknife where you can pull out the wrench or blade if you need it. Both of them can do the same things, but with one you have to be very, very careful to not cut yourself.

sqeaky 11y ago
> C++ is unsafe by default and you have to write lots extra checks to make sure your code is bulletproof No you don't, just use RAII and you cover almost all the safety issues. Put all memory allocations, file openings, mutex locking and other resource acquisition in constructors and the matching cleanup in deconstructors and it becomes very safe. Now, not only is memory cleaned up and exception safe, but several classes of file handling and multi-threading issues are categorically fixed. There are a few other rules to enhance this to the point of preposterous safety, but with just this technique I see fewer memory leaks than I do with some garbage collected languages. The big safety issues occur when people take the unplanned style of treating C++ as if it were C with Classes. Something that exacerbates this is a plethora of bad training material (mostly old from before C++03) and even university classes that use manual memory allocations outside a constructor (naked new statments), exceptions and manual memory releasing in exception unsafe ways. I am sure Ada can be used incorrectly, now imagine if in an old standard not all Ada compilers supported the same language features. Imagine the subset of common features was dangerous as hell. Imagine creating a memory structure like a linked list because only some compilers provided one prewritten and some are implementations were missing core language features. However, all the compilers ship with dangerous tools to build it wrong. This was C++ in 1995, and many people who learned it then never unlearned their mistakes. C++03 laid down a bunch of technical fixes and a minimum benchmark for decent compilers. It could have been used safely with what I described above, but much of the developer community was change averse. Now with C++11 we are changing and really cool things are happening because the developers are treating it like a different language.
nickpsecurity 11y ago
The pocketknife is a pretty good analogy. Like that one.
duaneb 11y ago
Sure. None of this is news to anyone. Why not discuss why C++ was chosen in the first place?
- Jtsummers 11y ago
  Ability to hire people to fill the role of programmer.
  - tremon 11y ago
    That sounds like they were looking to scrape the bottom of the barrel. If programmer salary played a key role for such a critical piece of software, they have bigger problems.
    - PeCaN 11y ago
      From what I understand from this thread, it's worse than that: The problem wasn't programmer salary, it was that their budget was so big that they wanted to hire extra people and could not find enough Ada programmers. Yup. It got written in C++ because they wanted to spend more money and there are more experienced C++ developers than Ada developers.
snuxoll 11y ago
I mean, if you stick with the stack and avoid pointer manipulations C++ can be pretty damned safe. Still, there's a reason Ada is typically used for things like flight control systems....
tome 11y ago
> Haskell or Ada (both of which can in some cases be formally verified to follow the spec) Haskell doesn't even have a spec
- PeCaN 11y ago
  Sorry, I was referring to the spec for the program, not the spec for the language. And Haskell does actually have a spec[1], but almost everyone uses GHC extensions so I suppose that's kind of moot. 1. https://wiki.haskell.org/Language_and_library_specification https://wiki.haskell.org/Language_and_library_specification
planteen 11y ago
Is Haskell suitable for real-time software?
- tome 11y ago
  No, not least because it's garbage collected. It may be useful for writing a DSL in which to write real-time software though: http://ivorylang.org/tower-overview.html http://ivorylang.org/tower-overview.html

by PeCaN 11y ago

sqeaky 11y ago

> C++ is unsafe by default and you have to write lots extra checks to make sure your code is bulletproof No you don't, just use RAII and you cover almost all the safety issues. Put all memory allocations, file openings, mutex locking and other resource acquisition in constructors and the matching cleanup in deconstructors and it becomes very safe. Now, not only is memory cleaned up and exception safe, but several classes of file handling and multi-threading issues are categorically fixed. There are a few other rules to enhance this to the point of preposterous safety, but with just this technique I see fewer memory leaks than I do with some garbage collected languages. The big safety issues occur when people take the unplanned style of treating C++ as if it were C with Classes. Something that exacerbates this is a plethora of bad training material (mostly old from before C++03) and even university classes that use manual memory allocations outside a constructor (naked new statments), exceptions and manual memory releasing in exception unsafe ways. I am sure Ada can be used incorrectly, now imagine if in an old standard not all Ada compilers supported the same language features. Imagine the subset of common features was dangerous as hell. Imagine creating a memory structure like a linked list because only some compilers provided one prewritten and some are implementations were missing core language features. However, all the compilers ship with dangerous tools to build it wrong. This was C++ in 1995, and many people who learned it then never unlearned their mistakes. C++03 laid down a bunch of technical fixes and a minimum benchmark for decent compilers. It could have been used safely with what I described above, but much of the developer community was change averse. Now with C++11 we are changing and really cool things are happening because the developers are treating it like a different language.

nickpsecurity 11y ago

The pocketknife is a pretty good analogy. Like that one.

duaneb 11y ago

Sure. None of this is news to anyone. Why not discuss why C++ was chosen in the first place?

Jtsummers 11y ago
Ability to hire people to fill the role of programmer.
- tremon 11y ago
  That sounds like they were looking to scrape the bottom of the barrel. If programmer salary played a key role for such a critical piece of software, they have bigger problems.
  - PeCaN 11y ago
    From what I understand from this thread, it's worse than that: The problem wasn't programmer salary, it was that their budget was so big that they wanted to hire extra people and could not find enough Ada programmers. Yup. It got written in C++ because they wanted to spend more money and there are more experienced C++ developers than Ada developers.

snuxoll 11y ago

I mean, if you stick with the stack and avoid pointer manipulations C++ can be pretty damned safe. Still, there's a reason Ada is typically used for things like flight control systems....

tome 11y ago

> Haskell or Ada (both of which can in some cases be formally verified to follow the spec) Haskell doesn't even have a spec

PeCaN 11y ago
Sorry, I was referring to the spec for the program, not the spec for the language. And Haskell does actually have a spec[1], but almost everyone uses GHC extensions so I suppose that's kind of moot. 1. https://wiki.haskell.org/Language_and_library_specification https://wiki.haskell.org/Language_and_library_specification

planteen 11y ago

Is Haskell suitable for real-time software?

tome 11y ago
No, not least because it's garbage collected. It may be useful for writing a DSL in which to write real-time software though: http://ivorylang.org/tower-overview.html http://ivorylang.org/tower-overview.html