4 ms·

Yet another subtle pro-Rust rant against C. Programming is hard, and writing safe code requires knowledge, not just in C, but in every single language. Even in

Yet another subtle pro-Rust rant against C. Programming is hard, and writing safe code requires knowledge, not just in C, but in every single language. Even in formal-validable languages you can make mistakes: may be you'll not make errors by using sprintf, but can make others because of using a more complex language.

fulafel 9y ago
Good risk management is about cost vs payoff analysis. To address the risk of car accident, first you stop juggling chainsaws while driving, then you start to wear seatbelts, and then you start thinking about how the remaining inevitable driving mistakes can be mitigated through technology or practices.
- posterboy 9y ago
  Safe subsets of C exist already. Any safeguards active at compile time could in principle be achieved via static code analysis. Only, if that means making assumptions and transformation to a different type system, that's like putting an old engine in a new car.
- faragon 9y ago
  Sure. And the best "insurance" is having competent programmers.
  - tormeh 9y ago
    Yes, competent drivers help, but I'm not sure a competent driver juggling chainsaws is better at driving than a bad driver not juggling chainsaws.
  - CJefferson 9y ago
    There seems to be no major C system not infested with errors most other languages forbid by design. The question is, do those other languages introduce their own types of errors? In my experience, no. Do they fix all problems? Of course not. Neither does a hard hat.
    - faragon 9y ago
      Do you know any big code base without bugs? That's not exclusive of C, e.g. check any big Java code base. Regarding Rust, I would like to see the kind od bugs that would arise in big code bases (thread contention, performance issues, etc.).
    - Loony2 9y ago
      I have to say that I feel as if the problem here isn't competent programmers though. It's competent testing that is lacking. Sure, it's possible to make a lot of stupid mistakes in C, but most of these mistakes should be found in testing, before the code is deployed. You'll probably say that "We don't even have those problems in language X." and I agree, but you should run the same tests no matter the language, because you want to find as many problems as possible, even if you write your code in language X.
- millstone 9y ago
  I guess using C is analogous is juggling chainsaws in your analogy. But is that actually less safe? Consider a component actually responsible for preventing car accidents, such as the anti-lock brake system. It will consist of input sensors, output signals, and an embedded computer running some code. All of these components have gone through an extensive qualification process. On the software side, the coding standard requires that all loops must be manifestly finite, no `continue`, no recursion, etc. This coding standard is enforced by the compiler, and the compiler itself must be certified, an extensive and difficult process on its own. Redundancy and review is applied at multiple levels, with tons of supporting tooling around requirements tracking and the like. Do that, and prove it over many years, and you can juggle chainsaws safely - or ride an explosion under your feet across the country. The key idea here is that things that have been proven safe, are safe. Using something unproven like Rust, it's nuts. Think about how big LLVM alone is! Rust doesn't have any of that, not the tooling, qualification, standards, or track record. It could be done, but you would need to pour tons of resources into it to bring Rust up to the level that C has in this space.
  - faragon 9y ago
    Rust has yet to prove that.
  - fulafel 9y ago
    This sounds like a very specialized C subset with nonstandad compilers, tooling and highly restricted functionality. Why use C as the starting point for such a language, instead of a hereditarily safer language like Pascal, Ada, etc?
ndr 9y ago
Rust does not appear in that page even once.
- kbenson 9y ago
  Reading between the lines, since he mentions Mozilla Rust is likely accountable for this post in some manner (even if loosely). That said, calling out this post as a pro-Rust rant against C is completely ignoring the fact that it might also be right, and origin is irrelevant. Positions should be evaluated based on their merits, not their origins.

fulafel 9y ago

Good risk management is about cost vs payoff analysis. To address the risk of car accident, first you stop juggling chainsaws while driving, then you start to wear seatbelts, and then you start thinking about how the remaining inevitable driving mistakes can be mitigated through technology or practices.

posterboy 9y ago
Safe subsets of C exist already. Any safeguards active at compile time could in principle be achieved via static code analysis. Only, if that means making assumptions and transformation to a different type system, that's like putting an old engine in a new car.
faragon 9y ago
Sure. And the best "insurance" is having competent programmers.
- tormeh 9y ago
  Yes, competent drivers help, but I'm not sure a competent driver juggling chainsaws is better at driving than a bad driver not juggling chainsaws.
- CJefferson 9y ago
  There seems to be no major C system not infested with errors most other languages forbid by design. The question is, do those other languages introduce their own types of errors? In my experience, no. Do they fix all problems? Of course not. Neither does a hard hat.
  - faragon 9y ago
    Do you know any big code base without bugs? That's not exclusive of C, e.g. check any big Java code base. Regarding Rust, I would like to see the kind od bugs that would arise in big code bases (thread contention, performance issues, etc.).
  - Loony2 9y ago
    I have to say that I feel as if the problem here isn't competent programmers though. It's competent testing that is lacking. Sure, it's possible to make a lot of stupid mistakes in C, but most of these mistakes should be found in testing, before the code is deployed. You'll probably say that "We don't even have those problems in language X." and I agree, but you should run the same tests no matter the language, because you want to find as many problems as possible, even if you write your code in language X.
millstone 9y ago
I guess using C is analogous is juggling chainsaws in your analogy. But is that actually less safe? Consider a component actually responsible for preventing car accidents, such as the anti-lock brake system. It will consist of input sensors, output signals, and an embedded computer running some code. All of these components have gone through an extensive qualification process. On the software side, the coding standard requires that all loops must be manifestly finite, no `continue`, no recursion, etc. This coding standard is enforced by the compiler, and the compiler itself must be certified, an extensive and difficult process on its own. Redundancy and review is applied at multiple levels, with tons of supporting tooling around requirements tracking and the like. Do that, and prove it over many years, and you can juggle chainsaws safely - or ride an explosion under your feet across the country. The key idea here is that things that have been proven safe, are safe. Using something unproven like Rust, it's nuts. Think about how big LLVM alone is! Rust doesn't have any of that, not the tooling, qualification, standards, or track record. It could be done, but you would need to pour tons of resources into it to bring Rust up to the level that C has in this space.
- faragon 9y ago
  Rust has yet to prove that.
- fulafel 9y ago
  This sounds like a very specialized C subset with nonstandad compilers, tooling and highly restricted functionality. Why use C as the starting point for such a language, instead of a hereditarily safer language like Pascal, Ada, etc?

ndr 9y ago

Rust does not appear in that page even once.

kbenson 9y ago
Reading between the lines, since he mentions Mozilla Rust is likely accountable for this post in some manner (even if loosely). That said, calling out this post as a pro-Rust rant against C is completely ignoring the fact that it might also be right, and origin is irrelevant. Positions should be evaluated based on their merits, not their origins.