3 ms·

Because again you are deviating from the industry standard completely portable lingua-franca language that is designed explicitly for precisely these types of p

by socmag 10y ago

Because again you are deviating from the industry standard completely portable lingua-franca language that is designed explicitly for precisely these types of problem spaces, and is perfectly in tune with the OS and existing standard library. What would be the advantage, just improved memory safety guarantees for people working on the project? If that's the case start again from scratch and the first thing you do is build a handle based memory management system that everything must go through Safexxxx() versions of everything and then explicitly enforce no other memory access patterns. If you want to do concurrency, build simple threads with input queues that would just be like channels in Go. You can use a completely functional actor model in C. Is all this object oriented dangling pointer stuff that is scary, but there really isn't any need for that. Software pipelines with slab allocation or ring buffers virtually guarantee no leaks and are very scalable and cache friendly. That would be my personal recommendation.

vertex-four 10y ago
C programs don't tend to be in tune with the OS and existing standard library if they support more than one OS. You need a heavy abstraction layer by the time you're doing anything vaguely complicated - which Tor is, by simply using an event loop. It's also not super-easy to interface with crypto libraries safely without building an abstraction layer. So you're a few hops away from being "in tune" to start. Rust provides, among other things, a decent type system that can encode some of your invariants in a manner that's a lot clearer - and every operation goes through the equivalent of your Safexxxx() functions by default, making the actual logic of what you're trying to do further clearer. A reasonable error handling mechanism is also built into the standard library and partially into the language, rather than checking return values for -1, or is it 0, and is the actual error in errno or was that function actually meant to return a value between -1 and -100 corresponding to the error, etc etc.
geofft 10y ago
You can do all of these things in C - but at the point that you're enforcing use of your Safexxxx() functions, you've already given up on the industry standard. You can't use the normal OS libraries; you've got to route everything through your special functions. The advantage of Rust is, honestly, that it has a community of people who are excited to do this sort of work in a language. At least 50% of the advantage of any particular language is not the benefits of the language directly, but the community around it (that derives indirectly from the benefits of the language, but also from marketing and other things). Some time ago I needed to write bindings to SCM_RIGHTS / CMSG_*, which is probably the trickiest part of the libc API (all of cmsg(3) is macros that do stupid things with casts). It was annoying, but it led to a better interface than C itself offers, and someone else found a bug in the OS X handling. I couldn't expect that if I were working on my own custom reimplementation of libc.
- socmag 10y ago
  So basically what it comes down to is the argument for building it in Rust is there are some excited people. And is funny you talk about community, since as the guys on slashdot and others pointed out, the community of people who can use and work in C effectively is orders of magnitudes more than Rust. Have you any idea how many Linux Kernel developers there are alone? http://m.slashdot.org/story/324469 http://m.slashdot.org/story/324469 Building API's specific to the use case is part of our jobs as professional developers. Abstracting a few things things isn't "rewriting libc", that is just general practice for most decent size projects. Anyway, the decision is made, so the whole thing is moot at this point.
  - geofft 10y ago
    > the community of people who can use and work in C effectively is orders of magnitudes more than Rust The key word here is "effectively." For the purposes at hand, effectiveness includes memory-safety. Do you know of a single project that implements cmsg(3) in C or C++ in a memory-safe, well-typed, cross-platform way? Or a project where I can submit a pull request and expect it to be reviewed, tested across platforms, and fixed? I do genuinely believe that the community of people who can use and work in C effectively, in the sense of effectiveness that I and the Tor Project are interested in, is orders of magnitudes smaller than Rust. I have a very good idea of how many Linux kernel developers there are - and also how many high-severity security bugs there are. I'm a coauthor of a research paper where we wanted to talk about exploitable security bugs in Linux, so we sat down and found a local privilege escalation in hours (CVE-2009-0024).

by socmag 10y ago

vertex-four 10y ago

C programs don't tend to be in tune with the OS and existing standard library if they support more than one OS. You need a heavy abstraction layer by the time you're doing anything vaguely complicated - which Tor is, by simply using an event loop. It's also not super-easy to interface with crypto libraries safely without building an abstraction layer. So you're a few hops away from being "in tune" to start. Rust provides, among other things, a decent type system that can encode some of your invariants in a manner that's a lot clearer - and every operation goes through the equivalent of your Safexxxx() functions by default, making the actual logic of what you're trying to do further clearer. A reasonable error handling mechanism is also built into the standard library and partially into the language, rather than checking return values for -1, or is it 0, and is the actual error in errno or was that function actually meant to return a value between -1 and -100 corresponding to the error, etc etc.

geofft 10y ago

You can do all of these things in C - but at the point that you're enforcing use of your Safexxxx() functions, you've already given up on the industry standard. You can't use the normal OS libraries; you've got to route everything through your special functions. The advantage of Rust is, honestly, that it has a community of people who are excited to do this sort of work in a language. At least 50% of the advantage of any particular language is not the benefits of the language directly, but the community around it (that derives indirectly from the benefits of the language, but also from marketing and other things). Some time ago I needed to write bindings to SCM_RIGHTS / CMSG_*, which is probably the trickiest part of the libc API (all of cmsg(3) is macros that do stupid things with casts). It was annoying, but it led to a better interface than C itself offers, and someone else found a bug in the OS X handling. I couldn't expect that if I were working on my own custom reimplementation of libc.

socmag 10y ago
So basically what it comes down to is the argument for building it in Rust is there are some excited people. And is funny you talk about community, since as the guys on slashdot and others pointed out, the community of people who can use and work in C effectively is orders of magnitudes more than Rust. Have you any idea how many Linux Kernel developers there are alone? http://m.slashdot.org/story/324469 http://m.slashdot.org/story/324469 Building API's specific to the use case is part of our jobs as professional developers. Abstracting a few things things isn't "rewriting libc", that is just general practice for most decent size projects. Anyway, the decision is made, so the whole thing is moot at this point.
- geofft 10y ago
  > the community of people who can use and work in C effectively is orders of magnitudes more than Rust The key word here is "effectively." For the purposes at hand, effectiveness includes memory-safety. Do you know of a single project that implements cmsg(3) in C or C++ in a memory-safe, well-typed, cross-platform way? Or a project where I can submit a pull request and expect it to be reviewed, tested across platforms, and fixed? I do genuinely believe that the community of people who can use and work in C effectively, in the sense of effectiveness that I and the Tor Project are interested in, is orders of magnitudes smaller than Rust. I have a very good idea of how many Linux kernel developers there are - and also how many high-severity security bugs there are. I'm a coauthor of a research paper where we wanted to talk about exploitable security bugs in Linux, so we sat down and found a local privilege escalation in hours (CVE-2009-0024).