4 ms·

That is definitely why we need to stop using C. It's beyond ridiculous.

by pka 10y ago

sangnoir 10y ago
Not as ridiculous as the costs of rewriting monstrous codebases that thousands of people worked on over many years. Let's not lose our sense of scale. Businesses love money more than they love C, if rewriting made economic sense, it wouldn't need to be lobbied.
- pka 10y ago
  It doesn't make economic sense because VMWare and Microsoft don't have to pay out of pocket if a box in a datacenter is compromised and data is leaked because of bugs in their VMs and kernels that are only possible because of C. This is like hiring somebody to build a bridge, it falling due to incompetence killing hundreds of people and then having nobody suffer any consequences. "Eh, bridges fall, what can you do." Make people pay for buffer overflows and C is gone tomorrow.
  - jacquesm 10y ago
    Make people liable for software bugs and IT will be gone tomorrow.
    - pka 10y ago
      There will always be software bugs. What I'm trying to say is that people should be made liable for avoidable bugs due to incompetence or ill-placed personal preferences ("Real programmers write in C!11"). There are times when C is unavoidable, unfortunately, but when somebody chooses a technology regardless of better, safer alternatives, "just because", they should be made liable, absolutely.
      - jacquesm 10y ago
        It's a matter of economics already. There are safer, better alternatives for almost everything we do. But economy dictates that we end up with a compromise. Rust would be just another compromise, slightly different stage, no huge difference and potentially a huge cost. Silver bullets in software development do not exist, rust is no exception to this and the irrational hyping of rust as being a silver bullet actually has the opposite effect. If rust is that much better at all aspects of software development (and not just in preventing one class of bugs) then it will find mainstream adoption. But you don't get that effect by ramming it down other people's throats, you get that effect by showing it in practice. And this is where rust - at least so far - is underwhelming. Also, and this is another point of irritation with me, the rust community makes it seem as if theirs is the only language that will avoid this kind of bug, which is far from true, there are other platforms / languages with far wider adoption that have these traits as well.
        staticassertion 10y ago
        > There are safer, better alternatives for almost everything we do. But economy dictates that we end up with a compromise. Rust would be just another compromise, slightly different stage, no huge difference and potentially a huge cost. I think the argument is that the economics need to change. People need to stop being irresponsible - we need liability when someone is negligent, just like in any other engineering discipline. > Silver bullets in software development do not exist, rust is no exception to this and the irrational hyping of rust as being a silver bullet actually has the opposite effect. I keep seeing this, and yet I have not once seen anyone call it a silver bullet. > Also, and this is another point of irritation with me, the rust community makes it seem as if theirs is the only language that will avoid this kind of bug, which is far from true, there are other platforms / languages with far wider adoption that have these traits as well. Show me another language with no garbage collection, memory safety, C/C++ level performance that has been anything other than academic.
        jacquesm 10y ago
        > I think the argument is that the economics need to change. People need to stop being irresponsible - we need liability when someone is negligent, just like in any other engineering discipline. I totally agree with that and have been a long time proponent of liability for damage caused by software bugs. But that would have to be all bugs, not just some classes of bugs. > Show me another language with no garbage collection, memory safety, C/C++ level performance that has been anything other than academic. D. And by the way, rust is only 'memory safe' as long as you don't disable the safety mechanisms, so I think 'memory safe by default' would be a better way to describe it.
  - antod 10y ago
    > This is like hiring somebody to build a bridge, it falling due to incompetence killing hundreds of people and then having nobody suffer any consequences. "Eh, bridges fall, what can you do." You can't really use these analogies in a security context, because real world engineers aren't liable if their designs fail due to sabotage, overloading or other unexpected conditions outside the standards they designed to. Software is different to real world 'analog' engineering in that a single very small mistake can bring down the whole thing. Most civil engineering designs would be riddled with small mistakes like that, but the overall system has (multiple layers of) factors of safety built in and the ability of other parts to compensate. You can see how concrete buildings in war zones (even places with shoddy engineering standards to begin with) can take large fractions of their structure being shot away before failing. A software vulnerability though is like finding just one perfect place where a single bullet could bring the whole thing down.
  - Nomentatus 10y ago
    Good point - some rights can't be signed away by contracts and license agreements, no matter what those say. For example automobile manufacturers can't hand you a sales agreement that exempts them from (a whole list of) responsibilities, because governments recognize a public interest and pass laws insisting on safety standards, availability of parts for 20 years, etc, etc. Govts should now catch up with the modern world and recognize the public interest in computer infrastructure safety; by ensuring that IT can't license away its responsibility to take all reasonable measures to reduce risk (thus opening up liability as well.) At some point, using Rust - in many cases - even if it's more expensive, will be such a reasonable safety measure enforced by tort law or statute. Not quite yet, perhaps, because the language is young. But soon. The EU is now taking Google and other corporations to task for their user agreements (licenses), to try to get them into compliance with consumer law there. It's a start, I suppose. https://www.theregister.co.uk/2017/03/17/europe_facebook_google_twitter_fine/ https://www.theregister.co.uk/2017/03/17/europe_facebook_goo...
- duneroadrunner 10y ago
  That's one of the arguments for SaferCPlusPlus[1]. It's a (high performance) option for retrofitting memory safety to existing C/C++ codebases. It requires (straightforward) modifications to the existing code, but involves much less effort than a complete rewrite. A tool to (mostly) automate the required modifications is being worked on. (But more resources might hasten its progress, if any of those well-resourced entities wanted to redirect some of their efforts from vulnerability detection and mitigation to prevention :) Just out of curiosity, what kind of performance penalty are people be willing to accept in exchange for memory safety? [1] shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus https://github.com/duneroadrunner/SaferCPlusPlus

That is definitely why we need to stop using C. It's beyond ridiculous.

by pka 10y ago

That is definitely why we need to stop using C. It's beyond ridiculous.

Not as ridiculous as the costs of rewriting monstrous codebases that thousands of people worked on over many years. Let's not lose our sense of scale. Businesses love money more than they love C, if rewriting made economic sense, it wouldn't need to be lobbied.

pka 10y ago
It doesn't make economic sense because VMWare and Microsoft don't have to pay out of pocket if a box in a datacenter is compromised and data is leaked because of bugs in their VMs and kernels that are only possible because of C. This is like hiring somebody to build a bridge, it falling due to incompetence killing hundreds of people and then having nobody suffer any consequences. "Eh, bridges fall, what can you do." Make people pay for buffer overflows and C is gone tomorrow.
- jacquesm 10y ago
  Make people liable for software bugs and IT will be gone tomorrow.
  - pka 10y ago
    There will always be software bugs. What I'm trying to say is that people should be made liable for avoidable bugs due to incompetence or ill-placed personal preferences ("Real programmers write in C!11"). There are times when C is unavoidable, unfortunately, but when somebody chooses a technology regardless of better, safer alternatives, "just because", they should be made liable, absolutely.
    - jacquesm 10y ago
      It's a matter of economics already. There are safer, better alternatives for almost everything we do. But economy dictates that we end up with a compromise. Rust would be just another compromise, slightly different stage, no huge difference and potentially a huge cost. Silver bullets in software development do not exist, rust is no exception to this and the irrational hyping of rust as being a silver bullet actually has the opposite effect. If rust is that much better at all aspects of software development (and not just in preventing one class of bugs) then it will find mainstream adoption. But you don't get that effect by ramming it down other people's throats, you get that effect by showing it in practice. And this is where rust - at least so far - is underwhelming. Also, and this is another point of irritation with me, the rust community makes it seem as if theirs is the only language that will avoid this kind of bug, which is far from true, there are other platforms / languages with far wider adoption that have these traits as well.
      - staticassertion 10y ago
        > There are safer, better alternatives for almost everything we do. But economy dictates that we end up with a compromise. Rust would be just another compromise, slightly different stage, no huge difference and potentially a huge cost. I think the argument is that the economics need to change. People need to stop being irresponsible - we need liability when someone is negligent, just like in any other engineering discipline. > Silver bullets in software development do not exist, rust is no exception to this and the irrational hyping of rust as being a silver bullet actually has the opposite effect. I keep seeing this, and yet I have not once seen anyone call it a silver bullet. > Also, and this is another point of irritation with me, the rust community makes it seem as if theirs is the only language that will avoid this kind of bug, which is far from true, there are other platforms / languages with far wider adoption that have these traits as well. Show me another language with no garbage collection, memory safety, C/C++ level performance that has been anything other than academic.
        jacquesm 10y ago
        > I think the argument is that the economics need to change. People need to stop being irresponsible - we need liability when someone is negligent, just like in any other engineering discipline. I totally agree with that and have been a long time proponent of liability for damage caused by software bugs. But that would have to be all bugs, not just some classes of bugs. > Show me another language with no garbage collection, memory safety, C/C++ level performance that has been anything other than academic. D. And by the way, rust is only 'memory safe' as long as you don't disable the safety mechanisms, so I think 'memory safe by default' would be a better way to describe it.
- antod 10y ago
  > This is like hiring somebody to build a bridge, it falling due to incompetence killing hundreds of people and then having nobody suffer any consequences. "Eh, bridges fall, what can you do." You can't really use these analogies in a security context, because real world engineers aren't liable if their designs fail due to sabotage, overloading or other unexpected conditions outside the standards they designed to. Software is different to real world 'analog' engineering in that a single very small mistake can bring down the whole thing. Most civil engineering designs would be riddled with small mistakes like that, but the overall system has (multiple layers of) factors of safety built in and the ability of other parts to compensate. You can see how concrete buildings in war zones (even places with shoddy engineering standards to begin with) can take large fractions of their structure being shot away before failing. A software vulnerability though is like finding just one perfect place where a single bullet could bring the whole thing down.
- Nomentatus 10y ago
  Good point - some rights can't be signed away by contracts and license agreements, no matter what those say. For example automobile manufacturers can't hand you a sales agreement that exempts them from (a whole list of) responsibilities, because governments recognize a public interest and pass laws insisting on safety standards, availability of parts for 20 years, etc, etc. Govts should now catch up with the modern world and recognize the public interest in computer infrastructure safety; by ensuring that IT can't license away its responsibility to take all reasonable measures to reduce risk (thus opening up liability as well.) At some point, using Rust - in many cases - even if it's more expensive, will be such a reasonable safety measure enforced by tort law or statute. Not quite yet, perhaps, because the language is young. But soon. The EU is now taking Google and other corporations to task for their user agreements (licenses), to try to get them into compliance with consumer law there. It's a start, I suppose. https://www.theregister.co.uk/2017/03/17/europe_facebook_google_twitter_fine/ https://www.theregister.co.uk/2017/03/17/europe_facebook_goo...
duneroadrunner 10y ago
That's one of the arguments for SaferCPlusPlus[1]. It's a (high performance) option for retrofitting memory safety to existing C/C++ codebases. It requires (straightforward) modifications to the existing code, but involves much less effort than a complete rewrite. A tool to (mostly) automate the required modifications is being worked on. (But more resources might hasten its progress, if any of those well-resourced entities wanted to redirect some of their efforts from vulnerability detection and mitigation to prevention :) Just out of curiosity, what kind of performance penalty are people be willing to accept in exchange for memory safety? [1] shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus https://github.com/duneroadrunner/SaferCPlusPlus