5 ms·

I feel like that $3.6 Million in funding go a lot further if spent on projects like the Rust Language.

by drew-y 9y ago

mirashii 9y ago
Rust isn't a panacea. Research funding should go towards exploring a wide array of subjects. Doing anything else ends up with a monoculture.
- drew-y 9y ago
  Agreed. Although I do think that memory safe systems languages are seriously low hanging fruit.
ComputerGuru 9y ago
So instead of spending money on a completely revolutionary approach that would add an additional layer of security in addition to whatever an up-and-coming language that's already doing a tremendous job at raising awareness about the relationship of programming languages and security as it invents a new paradigm (the borrow checker), we should just give it to focus on the latter?
nickpsecurity 9y ago
Rust's safety was partly inspired from such spending on Cyclone, a safe version of C. The NSF and other organizations fund tons of work on clean-slate languages, type systems, formal methods, etc. The academic incentives usually lead to quickly thrown together prototypes that arent production ready. Even the good ones rarely get used by programmers in general. Ocaml was one of the exceptions. What gets adoption is normally a language/platform with a knock-off of their efforts pushed by a big company or used in a "killer app." Bandwagons in other words. The consistently-low adoption of clean-slate tech along with lock-in effecta means the opposite is true: massive investment should go into making most common tech more correct, secure, and recoverable as simple as possible for users. If clean-slate, it should stay close as possible to what people already know with clean integrations. We can also continue to invest in ground-breaking stuff for niches that use them (eg SPARK Ada for aerospace) and/or new bandwagons that might build on them (eg Rust ecosystem).
- nickelbox 9y ago
  I had forgotten Cyclone's name, thanks for the reminder. I've always felt kinda sad some of the small features like int@ didn't make their way back into C. I'm glad at least C++ has non-null pointers via references (but with stricter semantics and potentially undesirable syntactic sugar) and fat pointers via span<T>, but it's useless when I have to write in C for legacy reasons.
  - nickpsecurity 9y ago
    Trevor Jim revived it a bit with virtualization for those wanting to play with it: http://trevorjim.com/unfrozen-cyclone/ http://trevorjim.com/unfrozen-cyclone/
    - nickelbox 9y ago
      Oh, that looks interesting, thanks for the link!

I feel like that $3.6 Million in funding go a lot further if spent on projects like the Rust Language.

by drew-y 9y ago

I feel like that $3.6 Million in funding go a lot further if spent on projects like the Rust Language.

Rust isn't a panacea. Research funding should go towards exploring a wide array of subjects. Doing anything else ends up with a monoculture.

drew-y 9y ago
Agreed. Although I do think that memory safe systems languages are seriously low hanging fruit.

ComputerGuru 9y ago

So instead of spending money on a completely revolutionary approach that would add an additional layer of security in addition to whatever an up-and-coming language that's already doing a tremendous job at raising awareness about the relationship of programming languages and security as it invents a new paradigm (the borrow checker), we should just give it to focus on the latter?

nickpsecurity 9y ago

Rust's safety was partly inspired from such spending on Cyclone, a safe version of C. The NSF and other organizations fund tons of work on clean-slate languages, type systems, formal methods, etc. The academic incentives usually lead to quickly thrown together prototypes that arent production ready. Even the good ones rarely get used by programmers in general. Ocaml was one of the exceptions. What gets adoption is normally a language/platform with a knock-off of their efforts pushed by a big company or used in a "killer app." Bandwagons in other words. The consistently-low adoption of clean-slate tech along with lock-in effecta means the opposite is true: massive investment should go into making most common tech more correct, secure, and recoverable as simple as possible for users. If clean-slate, it should stay close as possible to what people already know with clean integrations. We can also continue to invest in ground-breaking stuff for niches that use them (eg SPARK Ada for aerospace) and/or new bandwagons that might build on them (eg Rust ecosystem).

nickelbox 9y ago
I had forgotten Cyclone's name, thanks for the reminder. I've always felt kinda sad some of the small features like int@ didn't make their way back into C. I'm glad at least C++ has non-null pointers via references (but with stricter semantics and potentially undesirable syntactic sugar) and fat pointers via span<T>, but it's useless when I have to write in C for legacy reasons.
- nickpsecurity 9y ago
  Trevor Jim revived it a bit with virtualization for those wanting to play with it: http://trevorjim.com/unfrozen-cyclone/ http://trevorjim.com/unfrozen-cyclone/
  - nickelbox 9y ago
    Oh, that looks interesting, thanks for the link!