5 ms·

> C works everywhere, and everyone knows C, or can learn it in a couple of weeks and get coding. You hit the nail in the head. The go-to tutorial and referenc

> C works everywhere, and everyone knows C, or can learn it in a couple of weeks and get coding. You hit the nail in the head. The go-to tutorial and reference book of C is «The C programming language» by Brian Kernighan and Dennis Ritchie, which provides a complete and very thorough description of C and its standard library in less than 260 pages. That's unbeatable. As a comparison, the go-to book for C++, «the C++ programming language» by Bjarne Stroustrup, goes beyond 1200 pages and doesn't cover some fundamental aspects of C++, and even «The Rust Programming Language» by Steve Klabnik and Carol Nichols, a book on a programming language which was designed to eat away C's market, is over 400 pages. This speaks volumes on the effort required by anyone to get on their feet and be productive with these programming language.

bluejekyll 9y ago
From the article: “One standard textbook takes 534 pages to explain secure coding standards in C“
- oblio 9y ago
  Yes, but that comes later. When Joe. D. Newbie wants to start programming, C seems quite approachable, conceptually. Hack away at things in an imperative fashion. There's a reason Visual Basic, Perl, PHP, Java (+IDEs), Javascript are/were the most popular languages. They're easy to get into. I'm not counting C++ because it was piggy-backing on C.
  - bluejekyll 9y ago
    You get safe programming for “free” in Rust. So those 400 pages mentioned are not equivalent to what you glean from the intro to C book. It’s not a fair comparison. Edit: fixed pronoun referencing gp...
    - rurban 9y ago
      No, Rust is not safe. From the 3 fundamental safeties: memory, concurrency and types, Rust only provides type safety.
      - steveklabnik 9y ago
        What do you mean? Memory and concurrency safety are so important that they're in the main slogan of the language.
      - Ar-Curunir 9y ago
        Rust has the first two, and a rather strong type system, which is soon getting the equivalent of higher minded types, putting it roughly on par with Haskell in that respect. How much stronger do you want your type systems to be?
    - syrrim 9y ago
      >You get safe programming for “free” in Rust. Not really. Rust will tell you your program is unsafe at compile time, whereas c will tell you at runtime. The major difference is that c sometimes won't tell you about an unsafe program, whereas rust will call perfectly safe programs unsafe. Note that for a beginner, the former is vastly preferable, because it allows them to iterate much faster. It doesn't matter if your code is buggy if you throw it away, and it doesn't matter if your code has security bugs if it will never be worth hacking.
  - kibwen 9y ago
    > When Joe. D. Newbie wants to start programming, C seems quite approachable, conceptually. Coming from Java, my first experience with C was trying to write a trivial program and seeing nothing but the text "Segmentation fault" at runtime. Expecting a nice Java-like backtrace to tell me where the error was, I raised my hand and asked the TA what a "Segmentation fault" meant, and how to get a backtrace. He laughed, rolled his eyes, and went back to playing Slime Volleyball. Compared to any other language in use these days, C is anything but approachable. And when it comes to learning "secure coding standards in C", as the grandparent comment mentions, one cannot risk putting that off lest they develop bad habits that are never undone (though other environments share this property as well to some degree, e.g. PHP and client-side Javascript).
    - sebcat 9y ago
      Coredumps and debuggers are a thing. Sounds more like a bad TA.
      - kibwen 9y ago
        I won't dispute the latter. :P But speaking as someone who knows his way around GDB, the experience of using it is nowhere near what a Javascript programmer (and let's face it: this is all new programmers) will be primed to expect via browser debugging tools, and the necessity of using it/frequency with which it must be used due to C's lack of a runtime (understandable) and weak type system (understandable for 1972) make it a frustrating choice for autodidacts looking to pick up a second language.
        megaman22 9y ago
        I'm extremely happy that I learned to program in QBasic and then C++, with that awful Bloodshed DevC++ compiler. Everything since (except Haskell...) has been baby-town frolics, in comparison.
        geezerjay 9y ago
        > Bloodshed DevC++ compiler God, this is the first time in over a decade that I see a reference to Bloodshed Dev-C++. IIRC, Dev-C++ was just an IDE, and the compiler was actually GCC. The IDE was actually very good for its days, and considering it was a free IDE before free IDEs were a thing.
  - jononor 9y ago
    Does learning to program safely come before or after one deploys the code to an IoT device or other networked service?
- geezerjay 9y ago
  > From the article: “One standard textbook takes 534 pages to explain secure coding standards in C“ If you wish to compare books on specialized topics, the book on C++'s STL by Jossutis spans over 1100 pages and the book on C++ Templates by Vandevoorde, Jossutis and Gregor spans over 800 pages.
steveklabnik 9y ago
Different books have different goals. K&R is short, but the standard is ~700 pages. The Rust book is over 400 pages, but contains entire chapters of just "let's build a project together." There's no spec yet like C has. Writing styles differ dramatically, K&R are more concise than I am, and don't dive into some details as much. Then, you may also consider the framing of "simple" vs "easy", they're not the same thing. And that's even if we agree that C is simple in the first place, which I personally consider not true. Basically, I don't think that comparing page counts of random documents says anything meaningful about language complexity.
- crispinb 9y ago
  As an aside I don't have time or any purpose beyond curiosity to learn Rust right now. But having glanced through the Rust book a few times, I wish I did. It's the sort of book (a bit like K&R in this sense) that could lead one astray ..
  - steveklabnik 9y ago
    Thank you; even saying "a bit like K&R" at all is high praise to me. That said, not everyone likes my writing style, so I'm glad that there are other books coming out as well.
- geezerjay 9y ago
  > Different books have different goals. K&R is short, but the standard is ~700 pages. ISO/IEC 9899:1999 is 554 pages, and the annex alone takes around 140 pages. ANSI ISO 9899:1990 is even shorter: 230 pages.
  - steveklabnik 9y ago
    I'm going by ISO/IEC 9899:201x, the draft, since I have not paid for the spec. This does include annexes, but some of them are normative... Really though, this just furthers my point; page count is a terrible metric for this.
nine_k 9y ago
I bet that manuals of Basic-80, Forth, Scheme, and Smalltalk are all short. The amount of power they give you differs drastically, though.
anonacct37 9y ago
"The C programming language" is a fantastic book and I treasure it. Unfortunately it's also not a book I would recommend to people who want to write good secure code.

bluejekyll 9y ago

From the article: “One standard textbook takes 534 pages to explain secure coding standards in C“

oblio 9y ago
Yes, but that comes later. When Joe. D. Newbie wants to start programming, C seems quite approachable, conceptually. Hack away at things in an imperative fashion. There's a reason Visual Basic, Perl, PHP, Java (+IDEs), Javascript are/were the most popular languages. They're easy to get into. I'm not counting C++ because it was piggy-backing on C.
- bluejekyll 9y ago
  You get safe programming for “free” in Rust. So those 400 pages mentioned are not equivalent to what you glean from the intro to C book. It’s not a fair comparison. Edit: fixed pronoun referencing gp...
  - rurban 9y ago
    No, Rust is not safe. From the 3 fundamental safeties: memory, concurrency and types, Rust only provides type safety.
    - steveklabnik 9y ago
      What do you mean? Memory and concurrency safety are so important that they're in the main slogan of the language.
    - Ar-Curunir 9y ago
      Rust has the first two, and a rather strong type system, which is soon getting the equivalent of higher minded types, putting it roughly on par with Haskell in that respect. How much stronger do you want your type systems to be?
  - syrrim 9y ago
    >You get safe programming for “free” in Rust. Not really. Rust will tell you your program is unsafe at compile time, whereas c will tell you at runtime. The major difference is that c sometimes won't tell you about an unsafe program, whereas rust will call perfectly safe programs unsafe. Note that for a beginner, the former is vastly preferable, because it allows them to iterate much faster. It doesn't matter if your code is buggy if you throw it away, and it doesn't matter if your code has security bugs if it will never be worth hacking.
- kibwen 9y ago
  > When Joe. D. Newbie wants to start programming, C seems quite approachable, conceptually. Coming from Java, my first experience with C was trying to write a trivial program and seeing nothing but the text "Segmentation fault" at runtime. Expecting a nice Java-like backtrace to tell me where the error was, I raised my hand and asked the TA what a "Segmentation fault" meant, and how to get a backtrace. He laughed, rolled his eyes, and went back to playing Slime Volleyball. Compared to any other language in use these days, C is anything but approachable. And when it comes to learning "secure coding standards in C", as the grandparent comment mentions, one cannot risk putting that off lest they develop bad habits that are never undone (though other environments share this property as well to some degree, e.g. PHP and client-side Javascript).
  - sebcat 9y ago
    Coredumps and debuggers are a thing. Sounds more like a bad TA.
    - kibwen 9y ago
      I won't dispute the latter. :P But speaking as someone who knows his way around GDB, the experience of using it is nowhere near what a Javascript programmer (and let's face it: this is all new programmers) will be primed to expect via browser debugging tools, and the necessity of using it/frequency with which it must be used due to C's lack of a runtime (understandable) and weak type system (understandable for 1972) make it a frustrating choice for autodidacts looking to pick up a second language.
      - megaman22 9y ago
        I'm extremely happy that I learned to program in QBasic and then C++, with that awful Bloodshed DevC++ compiler. Everything since (except Haskell...) has been baby-town frolics, in comparison.
        geezerjay 9y ago
        > Bloodshed DevC++ compiler God, this is the first time in over a decade that I see a reference to Bloodshed Dev-C++. IIRC, Dev-C++ was just an IDE, and the compiler was actually GCC. The IDE was actually very good for its days, and considering it was a free IDE before free IDEs were a thing.
- jononor 9y ago
  Does learning to program safely come before or after one deploys the code to an IoT device or other networked service?
geezerjay 9y ago
> From the article: “One standard textbook takes 534 pages to explain secure coding standards in C“ If you wish to compare books on specialized topics, the book on C++'s STL by Jossutis spans over 1100 pages and the book on C++ Templates by Vandevoorde, Jossutis and Gregor spans over 800 pages.

steveklabnik 9y ago

Different books have different goals. K&R is short, but the standard is ~700 pages. The Rust book is over 400 pages, but contains entire chapters of just "let's build a project together." There's no spec yet like C has. Writing styles differ dramatically, K&R are more concise than I am, and don't dive into some details as much. Then, you may also consider the framing of "simple" vs "easy", they're not the same thing. And that's even if we agree that C is simple in the first place, which I personally consider not true. Basically, I don't think that comparing page counts of random documents says anything meaningful about language complexity.

crispinb 9y ago
As an aside I don't have time or any purpose beyond curiosity to learn Rust right now. But having glanced through the Rust book a few times, I wish I did. It's the sort of book (a bit like K&R in this sense) that could lead one astray ..
- steveklabnik 9y ago
  Thank you; even saying "a bit like K&R" at all is high praise to me. That said, not everyone likes my writing style, so I'm glad that there are other books coming out as well.
geezerjay 9y ago
> Different books have different goals. K&R is short, but the standard is ~700 pages. ISO/IEC 9899:1999 is 554 pages, and the annex alone takes around 140 pages. ANSI ISO 9899:1990 is even shorter: 230 pages.
- steveklabnik 9y ago
  I'm going by ISO/IEC 9899:201x, the draft, since I have not paid for the spec. This does include annexes, but some of them are normative... Really though, this just furthers my point; page count is a terrible metric for this.

nine_k 9y ago

I bet that manuals of Basic-80, Forth, Scheme, and Smalltalk are all short. The amount of power they give you differs drastically, though.

anonacct37 9y ago

"The C programming language" is a fantastic book and I treasure it. Unfortunately it's also not a book I would recommend to people who want to write good secure code.