5 ms·

From the article: “One standard textbook takes 534 pages to explain secure coding standards in C“

oblio 9y ago
Yes, but that comes later. When Joe. D. Newbie wants to start programming, C seems quite approachable, conceptually. Hack away at things in an imperative fashion. There's a reason Visual Basic, Perl, PHP, Java (+IDEs), Javascript are/were the most popular languages. They're easy to get into. I'm not counting C++ because it was piggy-backing on C.
- bluejekyll 9y ago
  You get safe programming for “free” in Rust. So those 400 pages mentioned are not equivalent to what you glean from the intro to C book. It’s not a fair comparison. Edit: fixed pronoun referencing gp...
  - rurban 9y ago
    No, Rust is not safe. From the 3 fundamental safeties: memory, concurrency and types, Rust only provides type safety.
    - steveklabnik 9y ago
      What do you mean? Memory and concurrency safety are so important that they're in the main slogan of the language.
    - Ar-Curunir 9y ago
      Rust has the first two, and a rather strong type system, which is soon getting the equivalent of higher minded types, putting it roughly on par with Haskell in that respect. How much stronger do you want your type systems to be?
  - syrrim 9y ago
    >You get safe programming for “free” in Rust. Not really. Rust will tell you your program is unsafe at compile time, whereas c will tell you at runtime. The major difference is that c sometimes won't tell you about an unsafe program, whereas rust will call perfectly safe programs unsafe. Note that for a beginner, the former is vastly preferable, because it allows them to iterate much faster. It doesn't matter if your code is buggy if you throw it away, and it doesn't matter if your code has security bugs if it will never be worth hacking.
- kibwen 9y ago
  > When Joe. D. Newbie wants to start programming, C seems quite approachable, conceptually. Coming from Java, my first experience with C was trying to write a trivial program and seeing nothing but the text "Segmentation fault" at runtime. Expecting a nice Java-like backtrace to tell me where the error was, I raised my hand and asked the TA what a "Segmentation fault" meant, and how to get a backtrace. He laughed, rolled his eyes, and went back to playing Slime Volleyball. Compared to any other language in use these days, C is anything but approachable. And when it comes to learning "secure coding standards in C", as the grandparent comment mentions, one cannot risk putting that off lest they develop bad habits that are never undone (though other environments share this property as well to some degree, e.g. PHP and client-side Javascript).
  - sebcat 9y ago
    Coredumps and debuggers are a thing. Sounds more like a bad TA.
    - kibwen 9y ago
      I won't dispute the latter. :P But speaking as someone who knows his way around GDB, the experience of using it is nowhere near what a Javascript programmer (and let's face it: this is all new programmers) will be primed to expect via browser debugging tools, and the necessity of using it/frequency with which it must be used due to C's lack of a runtime (understandable) and weak type system (understandable for 1972) make it a frustrating choice for autodidacts looking to pick up a second language.
      - megaman22 9y ago
        I'm extremely happy that I learned to program in QBasic and then C++, with that awful Bloodshed DevC++ compiler. Everything since (except Haskell...) has been baby-town frolics, in comparison.
        geezerjay 9y ago
        > Bloodshed DevC++ compiler God, this is the first time in over a decade that I see a reference to Bloodshed Dev-C++. IIRC, Dev-C++ was just an IDE, and the compiler was actually GCC. The IDE was actually very good for its days, and considering it was a free IDE before free IDEs were a thing.
- jononor 9y ago
  Does learning to program safely come before or after one deploys the code to an IoT device or other networked service?
geezerjay 9y ago
> From the article: “One standard textbook takes 534 pages to explain secure coding standards in C“ If you wish to compare books on specialized topics, the book on C++'s STL by Jossutis spans over 1100 pages and the book on C++ Templates by Vandevoorde, Jossutis and Gregor spans over 800 pages.

Yes, but that comes later. When Joe. D. Newbie wants to start programming, C seems quite approachable, conceptually. Hack away at things in an imperative fashion. There's a reason Visual Basic, Perl, PHP, Java (+IDEs), Javascript are/were the most popular languages. They're easy to get into. I'm not counting C++ because it was piggy-backing on C.

bluejekyll 9y ago
You get safe programming for “free” in Rust. So those 400 pages mentioned are not equivalent to what you glean from the intro to C book. It’s not a fair comparison. Edit: fixed pronoun referencing gp...
- rurban 9y ago
  No, Rust is not safe. From the 3 fundamental safeties: memory, concurrency and types, Rust only provides type safety.
  - steveklabnik 9y ago
    What do you mean? Memory and concurrency safety are so important that they're in the main slogan of the language.
  - Ar-Curunir 9y ago
    Rust has the first two, and a rather strong type system, which is soon getting the equivalent of higher minded types, putting it roughly on par with Haskell in that respect. How much stronger do you want your type systems to be?
- syrrim 9y ago
  >You get safe programming for “free” in Rust. Not really. Rust will tell you your program is unsafe at compile time, whereas c will tell you at runtime. The major difference is that c sometimes won't tell you about an unsafe program, whereas rust will call perfectly safe programs unsafe. Note that for a beginner, the former is vastly preferable, because it allows them to iterate much faster. It doesn't matter if your code is buggy if you throw it away, and it doesn't matter if your code has security bugs if it will never be worth hacking.
kibwen 9y ago
> When Joe. D. Newbie wants to start programming, C seems quite approachable, conceptually. Coming from Java, my first experience with C was trying to write a trivial program and seeing nothing but the text "Segmentation fault" at runtime. Expecting a nice Java-like backtrace to tell me where the error was, I raised my hand and asked the TA what a "Segmentation fault" meant, and how to get a backtrace. He laughed, rolled his eyes, and went back to playing Slime Volleyball. Compared to any other language in use these days, C is anything but approachable. And when it comes to learning "secure coding standards in C", as the grandparent comment mentions, one cannot risk putting that off lest they develop bad habits that are never undone (though other environments share this property as well to some degree, e.g. PHP and client-side Javascript).
- sebcat 9y ago
  Coredumps and debuggers are a thing. Sounds more like a bad TA.
  - kibwen 9y ago
    I won't dispute the latter. :P But speaking as someone who knows his way around GDB, the experience of using it is nowhere near what a Javascript programmer (and let's face it: this is all new programmers) will be primed to expect via browser debugging tools, and the necessity of using it/frequency with which it must be used due to C's lack of a runtime (understandable) and weak type system (understandable for 1972) make it a frustrating choice for autodidacts looking to pick up a second language.
    - megaman22 9y ago
      I'm extremely happy that I learned to program in QBasic and then C++, with that awful Bloodshed DevC++ compiler. Everything since (except Haskell...) has been baby-town frolics, in comparison.
      - geezerjay 9y ago
        > Bloodshed DevC++ compiler God, this is the first time in over a decade that I see a reference to Bloodshed Dev-C++. IIRC, Dev-C++ was just an IDE, and the compiler was actually GCC. The IDE was actually very good for its days, and considering it was a free IDE before free IDEs were a thing.
jononor 9y ago
Does learning to program safely come before or after one deploys the code to an IoT device or other networked service?

geezerjay 9y ago

> From the article: “One standard textbook takes 534 pages to explain secure coding standards in C“ If you wish to compare books on specialized topics, the book on C++'s STL by Jossutis spans over 1100 pages and the book on C++ Templates by Vandevoorde, Jossutis and Gregor spans over 800 pages.