7 ms·

Written in C. What a shame. edit: Thank you to all of the repliers, I had no idea that most OSes were written in C. Er, actually, I'm more than well aware of t

Written in C. What a shame. edit: Thank you to all of the repliers, I had no idea that most OSes were written in C. Er, actually, I'm more than well aware of that fact and I'm familiar with the number of CVEs that have occurred over the years because of the lack of memory safety involved in that C code. Sorry, I simply don't get the appeal of writing more operating systems and network-exposed code that isn't written in a safer language. Say like Rust; see Redox.

charlesetc 10y ago
Let's ignore that your operating system is probably written in c.
Koshkin 10y ago
Actually, C is a perfect tool for writing portable operating systems.
oshepherd 10y ago
I love Rust immensely, and it is perhaps my favorite programming language as of late. However. This is a microkernel. There is very, very little code inside a microkernel which, if written in Rust, would not end up inside an unsafe block. You are building the safe abstractions here; that code is inherently unsafe. You could use Rust as a C replacement, but it is a worse C than C, and unsafe rust contains more perils (i.e. UB) than C.
- steveklabnik 10y ago
  Redox is microkernelish, and used to have a lot of unsafe, but has cut it down significantly. You'd be surprised :) That said, this is pretty much an open research question at this point, so you're right to be skeptical. (I would also argue that unsafe Rust has more _unspecified_ behavior than C, but not more undefined behavior, but until we get those semantics truly nailed down, can't say for sure. See above "open research question" comment)
  - eggy 10y ago
    The LK inner construct is ~15KB. I don't think you could use Rust's safety features and get that size for the LK portion. Maybe the Magenta portion of it though. "Magenta has a capability-based security model. In LK all code is trusted." Pony lang is a PL using capability-based concepts too.
    - steveklabnik 10y ago
      > I don't think you could use Rust's safety features and get that size for the LK portion. What do you mean? Rust's safety features are mostly compile-time; it shouldn't have implications for binary size. https://github.com/helena-project/tock https://github.com/helena-project/tock is an RTOS that runs on an Atmel SAM4L Cortex-M4, and is about ~30kb in size, in my understanding. But that's for the whole OS...
      - eggy 10y ago
        You're right about binary size. I shouldn't have worded it that way. The point I attempted to make is that when you go small, and pare away what you used to create it, you could have used C and verified it with a certifier/prover. How does Rust address this goal? Truly curious, since I just started learning Rust. I program in C, not C++. How does your example of the RTOS on the Cortex-M4 at ~30KB compare in complexity to LK at ~15KB in terms of what they deliver in that package size?
        steveklabnik 10y ago
        I don't know enough about LK to make the comparison. > How does Rust address this goal? Currently? Not as well. There's no total proof framework for Rust yet, it's too early. In a few years? The same way, but with more "proven" by default, without the extra tooling. Tool maturity is certainly one of the areas where C has a leg-up on Rust, by virtues of being decades older.
  - oshepherd 10y ago
    I took a quick peek at the redox source code and found kernel mode audio and network drivers. This is not a microkernel. As for UB: Maybe it has less, but that which exists (e.g. noalias on mut refs) is very dangerous.
- swetland 10y ago
  The Magenta kernel is maybe a bit more of a minikernel (97% of drivers and services live in userspace, but the syscall surface provides a wider variety of primitives than just send/recv/exit that a hardcore microkernel design might embrace). It inherits from LK, which was written in C, but the new surfaces in the Magenta kernel are written in C++ (a restrained, limited C++, intended to take advantage of nice things C++ brings without getting us in too much trouble in the controlled kernel environment). The core Magenta userspace drivers and services are mostly C at the moment, some will shift to C++ over time, and provided they use the same RPC protocols there's nothing preventing one from building such components in other languages once those other languages are building suitable binaries for Magenta.
- j-pb 10y ago
  You could probably write one in forth though ;p, what's good enough for EFI is good enough for the kernel. (You'd end up with a lot of inline assembly probably though, but hey that's less complicated than C++.)
  - tmzt 10y ago
    Did you mean OFW rather than EFI?
zigzigzag 10y ago
Why is this voted down? To build a new OS from scratch takes a huge effort. If you're going to do it then you should really try to advance the state of the art in big ways. An obvious way to do that is to use memory safe / managed code as deep as possible into the stack (and then you can do things like eliminate the notion of a process entirely). JNode is an example of the latter. Redox has a less radical architecture but is still on the right path. When Microsoft did their own new OS research project, Midori, that's the path they walked.
- sangnoir 10y ago
  > To build a new OS from scratch takes a huge effort. If you're going to do it then you should really try to advance the state of the art in big ways I do not get the impression that Fuchsia is a "research project", and it's purpose is not to advance the state of the art. > When Microsoft did their own new OS research project, Midori, that's the path they walked. How did it work out for them?
  - sroussey 10y ago
    Midori was really interesting. I don't know of another that removed context switching.
    - sangnoir 10y ago
      > Midori was really interesting No doubt, and so are some art-house movies I've watched - they usually leave me thinking (or flummoxed). There is a place for art-house movies and a place for more commercial fare (e.g. blockbusters) - it is important not to confuse the two.Some gifted auteurs manage to blend the two, but IMO,it is wrong for anyone to say "if you're taking the time to make a movie, make it intellectual"

charlesetc 10y ago

Let's ignore that your operating system is probably written in c.

Koshkin 10y ago

Actually, C is a perfect tool for writing portable operating systems.

oshepherd 10y ago

I love Rust immensely, and it is perhaps my favorite programming language as of late. However. This is a microkernel. There is very, very little code inside a microkernel which, if written in Rust, would not end up inside an unsafe block. You are building the safe abstractions here; that code is inherently unsafe. You could use Rust as a C replacement, but it is a worse C than C, and unsafe rust contains more perils (i.e. UB) than C.

steveklabnik 10y ago
Redox is microkernelish, and used to have a lot of unsafe, but has cut it down significantly. You'd be surprised :) That said, this is pretty much an open research question at this point, so you're right to be skeptical. (I would also argue that unsafe Rust has more _unspecified_ behavior than C, but not more undefined behavior, but until we get those semantics truly nailed down, can't say for sure. See above "open research question" comment)
- eggy 10y ago
  The LK inner construct is ~15KB. I don't think you could use Rust's safety features and get that size for the LK portion. Maybe the Magenta portion of it though. "Magenta has a capability-based security model. In LK all code is trusted." Pony lang is a PL using capability-based concepts too.
  - steveklabnik 10y ago
    > I don't think you could use Rust's safety features and get that size for the LK portion. What do you mean? Rust's safety features are mostly compile-time; it shouldn't have implications for binary size. https://github.com/helena-project/tock https://github.com/helena-project/tock is an RTOS that runs on an Atmel SAM4L Cortex-M4, and is about ~30kb in size, in my understanding. But that's for the whole OS...
    - eggy 10y ago
      You're right about binary size. I shouldn't have worded it that way. The point I attempted to make is that when you go small, and pare away what you used to create it, you could have used C and verified it with a certifier/prover. How does Rust address this goal? Truly curious, since I just started learning Rust. I program in C, not C++. How does your example of the RTOS on the Cortex-M4 at ~30KB compare in complexity to LK at ~15KB in terms of what they deliver in that package size?
      - steveklabnik 10y ago
        I don't know enough about LK to make the comparison. > How does Rust address this goal? Currently? Not as well. There's no total proof framework for Rust yet, it's too early. In a few years? The same way, but with more "proven" by default, without the extra tooling. Tool maturity is certainly one of the areas where C has a leg-up on Rust, by virtues of being decades older.
- oshepherd 10y ago
  I took a quick peek at the redox source code and found kernel mode audio and network drivers. This is not a microkernel. As for UB: Maybe it has less, but that which exists (e.g. noalias on mut refs) is very dangerous.
swetland 10y ago
The Magenta kernel is maybe a bit more of a minikernel (97% of drivers and services live in userspace, but the syscall surface provides a wider variety of primitives than just send/recv/exit that a hardcore microkernel design might embrace). It inherits from LK, which was written in C, but the new surfaces in the Magenta kernel are written in C++ (a restrained, limited C++, intended to take advantage of nice things C++ brings without getting us in too much trouble in the controlled kernel environment). The core Magenta userspace drivers and services are mostly C at the moment, some will shift to C++ over time, and provided they use the same RPC protocols there's nothing preventing one from building such components in other languages once those other languages are building suitable binaries for Magenta.
j-pb 10y ago
You could probably write one in forth though ;p, what's good enough for EFI is good enough for the kernel. (You'd end up with a lot of inline assembly probably though, but hey that's less complicated than C++.)
- tmzt 10y ago
  Did you mean OFW rather than EFI?

zigzigzag 10y ago

Why is this voted down? To build a new OS from scratch takes a huge effort. If you're going to do it then you should really try to advance the state of the art in big ways. An obvious way to do that is to use memory safe / managed code as deep as possible into the stack (and then you can do things like eliminate the notion of a process entirely). JNode is an example of the latter. Redox has a less radical architecture but is still on the right path. When Microsoft did their own new OS research project, Midori, that's the path they walked.

sangnoir 10y ago
> To build a new OS from scratch takes a huge effort. If you're going to do it then you should really try to advance the state of the art in big ways I do not get the impression that Fuchsia is a "research project", and it's purpose is not to advance the state of the art. > When Microsoft did their own new OS research project, Midori, that's the path they walked. How did it work out for them?
- sroussey 10y ago
  Midori was really interesting. I don't know of another that removed context switching.
  - sangnoir 10y ago
    > Midori was really interesting No doubt, and so are some art-house movies I've watched - they usually leave me thinking (or flummoxed). There is a place for art-house movies and a place for more commercial fare (e.g. blockbusters) - it is important not to confuse the two.Some gifted auteurs manage to blend the two, but IMO,it is wrong for anyone to say "if you're taking the time to make a movie, make it intellectual"