4 ms·

I write security critical software with C and I know exactly what you're talking about. It's written in C because the tooling to analyze and certify it for sec

by exDM69 10y ago

I write security critical software with C and I know exactly what you're talking about. It's written in C because the tooling to analyze and certify it for security in embedded/automotive/aerospace is targetting C (or C++). For some industries, Ada might be an alternative. It may be paradoxical, but you're not going to be able to write safety critical software in Rust because the tooling to certify it for security doesn't exist and it'll still take years to get there. Do I like this situation? No, I do not. Do I think it's a big problem? No, not big enough that it can't be solved by pouring money and engineering resources on it.

adrianN 10y ago
I also write safety critical software, in C++. I disagree that the necessary tooling for certification doesn't exist for Rust. You don't need that much tooling. Measuring test coverage is the hardest part (and Rust doesn't do this very well currently, but it is possible). Most of the things coding standards for C (e.g. MISRA) require are irrelevant for safer languages, so you don't need complex checkers. For static analysis the story is similar.
- jacobush 10y ago
  In safety stuff, not only has the source to be vetted. Also the compiler building the target binary must be blessed and hopefully well understood.
  - kodfodrasz 10y ago
    I have seen a certified compiler (GreenHill) compiling invalid code happily (not one relying on undefined behaviors), despite its certifications, for which even an ancient 3.x gcc complained (rightfully!) These certifications unfortunately often are on the level of the golden shields CAs provide to customers to put on their sites as sign of trustworthiness. So yes, blessed is a nice word for it.
    - jacobush 10y ago
      I hate GreenHill C compiler as much as the next guy [insert huge rant] but the Blessed Compiler of Choice in its frozen buggy state at least usually means it's a KNOWN ENTITY. We code around the bugs, we compile in -O0 mode etc etc, we analyze the assembler output to death and so on. I see these "certified" stamps less as "secure" and more of a huge slowing down of progress and change - which strangely can translate to more secure since you know what you are dealing with. If I can dream, I'd take a "certified" GNU Ada, or Rust, or something over C. But that is bound to take many years to happen if ever. I think we sooner will see Rust compiled to C which is fed to something like the abominable Greenhill so security consultants can pour over the intermediate C output and put it through the abominable Greenhill.
  - adrianN 10y ago
    Blessing a compiler consists of running it on a trivial test suite and writing down the results, however bad they may be.
  - aidenn0 10y ago
    For safety stuff I've worked on, the source had to be vetted, and then someone goes through line by line and confirms that the assembly generated for each line of code matches the source code. For C or Ada with conservative optimizations, this is fairly mechanical (and extremely boring), but means that trusting the compiler is not a requirement.
    - adrianN 10y ago
      Then you must have worked on tiny software.

by exDM69 10y ago

adrianN 10y ago

I also write safety critical software, in C++. I disagree that the necessary tooling for certification doesn't exist for Rust. You don't need that much tooling. Measuring test coverage is the hardest part (and Rust doesn't do this very well currently, but it is possible). Most of the things coding standards for C (e.g. MISRA) require are irrelevant for safer languages, so you don't need complex checkers. For static analysis the story is similar.

jacobush 10y ago
In safety stuff, not only has the source to be vetted. Also the compiler building the target binary must be blessed and hopefully well understood.
- kodfodrasz 10y ago
  I have seen a certified compiler (GreenHill) compiling invalid code happily (not one relying on undefined behaviors), despite its certifications, for which even an ancient 3.x gcc complained (rightfully!) These certifications unfortunately often are on the level of the golden shields CAs provide to customers to put on their sites as sign of trustworthiness. So yes, blessed is a nice word for it.
  - jacobush 10y ago
    I hate GreenHill C compiler as much as the next guy [insert huge rant] but the Blessed Compiler of Choice in its frozen buggy state at least usually means it's a KNOWN ENTITY. We code around the bugs, we compile in -O0 mode etc etc, we analyze the assembler output to death and so on. I see these "certified" stamps less as "secure" and more of a huge slowing down of progress and change - which strangely can translate to more secure since you know what you are dealing with. If I can dream, I'd take a "certified" GNU Ada, or Rust, or something over C. But that is bound to take many years to happen if ever. I think we sooner will see Rust compiled to C which is fed to something like the abominable Greenhill so security consultants can pour over the intermediate C output and put it through the abominable Greenhill.
- adrianN 10y ago
  Blessing a compiler consists of running it on a trivial test suite and writing down the results, however bad they may be.
- aidenn0 10y ago
  For safety stuff I've worked on, the source had to be vetted, and then someone goes through line by line and confirms that the assembly generated for each line of code matches the source code. For C or Ada with conservative optimizations, this is fairly mechanical (and extremely boring), but means that trusting the compiler is not a requirement.
  - adrianN 10y ago
    Then you must have worked on tiny software.