6 ms·

Agreed 100%. Definitely going to be trotting this article out next time I see someone blindly arguing for rewriting xyz in Rust. I particularly like the mentio

Agreed 100%. Definitely going to be trotting this article out next time I see someone blindly arguing for rewriting xyz in Rust. I particularly like the mention of portability. No other language comes even remotely close to the portability of C. What other language runs on Linux, NT, BSD, Minix, Mach, VAX, Solaris, plan9, Hurd, eight dozen other platforms, freestanding kernels, and nearly every architecture ever made?

cwyers 10y ago
I mean, sure, and if you have users running VAX or the Hurd, that matters. But it turns out that most of us use one of Linux, NT or OS X. And even if you add BSD and Solaris (and a few other Unixes) you can still find languages without C's known problems that cover 100% of users. "But embedded." Embedded can maintain their own software, they do all the time. How long are we going to insist that end users run software that cannot be secure because of the lowest common denominator of programming languages?
- Sir_Cmpwn 10y ago
  I think this is a flawed mindset for a number of reasons. First, I'd rather appeal to every user than most users. That one user I didn't have to appeal to is going to be a much more faithful and grateful user than the "normal" ones. Most of my software work is open source (remember this context is a discussion about curl), and this encourages active collaboration with users with niche situations. If I choose technologies that make using my software attainable for these people, odds are they aren't going to stop at just porting it to their platform. Limiting your platforms to Linux, OSX, and NT also stifles innovation. These platforms are all deeply flawed. Their popularity isn't due to having the best design, but rather to having a good enough design and being entrenched. They're old platforms, we've learned a lot since they were started. New or niche platforms bring a lot of value to the table. The BSDs are a great example, as it's the best suited platform for a wide variety of applications. All a new platform has to do to be able to run nearly all general purpose software is port a C compiler. Not even that - they just need a cross compiler. This is a great thing, IMO. >Embedded can maintain their own software, they do all the time This is a pretty silly argument. Most embedded developers don't ship their own implementation of HTTP, they ship curl!
  - cwyers 10y ago
    > Their popularity isn't due to having the best design, but rather to having a good enough design and being entrenched. They're old platforms, we've learned a lot since they were started. I think one could say the same thing about C's popularity as a language.
    - Sir_Cmpwn 10y ago
      I disagree. I think C is extremely well designed, but there are unfixable shortcomings to this design. Choosing it is a tradeoff.
      - cwyers 10y ago
        You don't think we've learned a lot about how to design programming languages since C was developed?
        Sir_Cmpwn 10y ago
        I think we've regressed in many ways, to be honest.
        cwyers 10y ago
        I find it rather implausible that we've managed to learn a lot of new things about operating system design and nothing about language design when the last major new operating system design to see significant adoption was probably NT in 1993, and we've had boatloads of new languages see adoption since then. Because the talent and effort is going to go where the rewards are, and if designing new languages is more productive than developing new operating systems, I would think that's where most of the energy is going. The inverse of Sturgeon's Law is that 20% of everything isn't crap, and the more of something you have, the larger that 20% is.
        Sir_Cmpwn 10y ago
        The main difference is that operating systems are complicated and programming languages (are supposed to be) simple. The biggest strength of C is its simplicity - there's not much that can go wrong with such a small feature set. I find Go to be pretty strong for similar reasons.
- smitherfield 10y ago
  Most of libcurl's users are in the embedded space, where they might not even be running an OS at all. So portability does still have to be a primary concern.
NoGravitas 10y ago
I think the strongest argument is "rewriting would introduce lots of new bugs that we don't have now". It's a lot easier to justify staying the course with C on a project that has its troubled youth long behind it, than it is to justify starting a new project in C now.
- naasking 10y ago
  Curl had more vulnerabilities reported this past year than the previous two years combined. The number of bugs is growing year over year now that automated checking tools are mainstream. The number of problems revealed is accelerating, not slowing down as you seem to think.
  - dbaupp 10y ago
    Just looking at the numbers is misleading: curl had a security audit last year ( https://daniel.haxx.se/blog/2016/11/23/curl-security-audit/ https://daniel.haxx.se/blog/2016/11/23/curl-security-audit/ ), which may mean much fewer are reported over the next few years, as they were all found last year.
    - naasking 10y ago
      > as they were all found last year Wishful thinking! But I suppose we'll see.

cwyers 10y ago

I mean, sure, and if you have users running VAX or the Hurd, that matters. But it turns out that most of us use one of Linux, NT or OS X. And even if you add BSD and Solaris (and a few other Unixes) you can still find languages without C's known problems that cover 100% of users. "But embedded." Embedded can maintain their own software, they do all the time. How long are we going to insist that end users run software that cannot be secure because of the lowest common denominator of programming languages?

Sir_Cmpwn 10y ago
I think this is a flawed mindset for a number of reasons. First, I'd rather appeal to every user than most users. That one user I didn't have to appeal to is going to be a much more faithful and grateful user than the "normal" ones. Most of my software work is open source (remember this context is a discussion about curl), and this encourages active collaboration with users with niche situations. If I choose technologies that make using my software attainable for these people, odds are they aren't going to stop at just porting it to their platform. Limiting your platforms to Linux, OSX, and NT also stifles innovation. These platforms are all deeply flawed. Their popularity isn't due to having the best design, but rather to having a good enough design and being entrenched. They're old platforms, we've learned a lot since they were started. New or niche platforms bring a lot of value to the table. The BSDs are a great example, as it's the best suited platform for a wide variety of applications. All a new platform has to do to be able to run nearly all general purpose software is port a C compiler. Not even that - they just need a cross compiler. This is a great thing, IMO. >Embedded can maintain their own software, they do all the time This is a pretty silly argument. Most embedded developers don't ship their own implementation of HTTP, they ship curl!
- cwyers 10y ago
  > Their popularity isn't due to having the best design, but rather to having a good enough design and being entrenched. They're old platforms, we've learned a lot since they were started. I think one could say the same thing about C's popularity as a language.
  - Sir_Cmpwn 10y ago
    I disagree. I think C is extremely well designed, but there are unfixable shortcomings to this design. Choosing it is a tradeoff.
    - cwyers 10y ago
      You don't think we've learned a lot about how to design programming languages since C was developed?
      - Sir_Cmpwn 10y ago
        I think we've regressed in many ways, to be honest.
        cwyers 10y ago
        I find it rather implausible that we've managed to learn a lot of new things about operating system design and nothing about language design when the last major new operating system design to see significant adoption was probably NT in 1993, and we've had boatloads of new languages see adoption since then. Because the talent and effort is going to go where the rewards are, and if designing new languages is more productive than developing new operating systems, I would think that's where most of the energy is going. The inverse of Sturgeon's Law is that 20% of everything isn't crap, and the more of something you have, the larger that 20% is.
        Sir_Cmpwn 10y ago
        The main difference is that operating systems are complicated and programming languages (are supposed to be) simple. The biggest strength of C is its simplicity - there's not much that can go wrong with such a small feature set. I find Go to be pretty strong for similar reasons.
smitherfield 10y ago
Most of libcurl's users are in the embedded space, where they might not even be running an OS at all. So portability does still have to be a primary concern.

NoGravitas 10y ago

I think the strongest argument is "rewriting would introduce lots of new bugs that we don't have now". It's a lot easier to justify staying the course with C on a project that has its troubled youth long behind it, than it is to justify starting a new project in C now.

naasking 10y ago
Curl had more vulnerabilities reported this past year than the previous two years combined. The number of bugs is growing year over year now that automated checking tools are mainstream. The number of problems revealed is accelerating, not slowing down as you seem to think.
- dbaupp 10y ago
  Just looking at the numbers is misleading: curl had a security audit last year ( https://daniel.haxx.se/blog/2016/11/23/curl-security-audit/ https://daniel.haxx.se/blog/2016/11/23/curl-security-audit/ ), which may mean much fewer are reported over the next few years, as they were all found last year.
  - naasking 10y ago
    > as they were all found last year Wishful thinking! But I suppose we'll see.