6 ms·
Short review: Another OS written in C/C++ that will have a million and one bugs over the next 3 decades.
by mtgx 9y ago
Short review: Another OS written in C/C++ that will have a million and one bugs over the next 3 decades.
- trav4225 9y agoI'd say the same thing without narrowing the statement to C/C++. ;-)
- liuw 9y agoWhy focus on the language and the possibility of a million and one bugs but not the architecture and design choices?
- Sir_Cmpwn 9y agoBecause it's an easy indicator of someone who has no idea what they're doing in OS development. Choosing the wrong tool for the job is meaningful. Have you ever looked through Chromium's C++ codebase? The same people are working on this and it tells us that they haven't learned their lesson (or they want to tightly integrate Chrome with Fuschia, which is also a foreboding sign). Edit: I should clarify that I think C is the only rational choice and that Rust is ill suited to osdev as well. I'm only talking about C++ here.
- happyguy43 9y agoNah, writing a kernel in modern C++ or Rust is pretty rad. Higher level abstractions can be designed to avoid bugs (As evidenced by the explosion of macros in the Linux code base). Check out L4Ka::Pistachio https://github.com/l4ka/pistachio https://github.com/l4ka/pistachio
- greenhouse_gas 9y agoI know you're a prolific commentator here, so if you don't mind me asking ... Which operating systems have you designed (or worked on) to say that writing a microkernel in C is a symptom that they don't know anything about OS development?
- Sir_Cmpwn 9y agoWriting a microkernel in C is fine. I said _C++_. But for the record, I built this: https://github.com/KnightOS/kernel https://github.com/KnightOS/kernel And I've worked on toy kernels here and there and studied more serious kernels in depth.
- kajecounterhack 9y agoYou're probably missing their tradeoffs. Google has deep expertise in C++ within the company and integration with existing libraries / tools is a huge bonus. So if the goal is a market-ready product and velocity matters, then it makes sense not to adopt a new language that is still changing a lot. It's only your opinion that they've chosen the wrong tool. There isn't one right answer to nuanced product decisions.
- Sir_Cmpwn 9y ago>then it makes sense not to adopt a new language that is still changing a lot I should clarify that I agree with eddieh and think C is the only rational choice.
- coldtea 9y ago>Because it's an easy indicator of someone who has no idea what they're doing in OS development. Actually suggesting Rust as some kind of magic bullet over C/C++ is a huge indicator "of someone who has no idea what they're doing in OS development". It's similar to when first year CS students learn that assembly is "faster" (a hazy notion itself), and then want everything to be written in assembly.
- Sir_Cmpwn 9y agoAdded to my comment: >Edit: I should clarify that I think C is the only rational choice and that Rust is ill suited to osdev as well. I'm only talking about C++ here.
- jrimbault 9y ago>It's similar to when first year CS students learn that assembly is "faster" (a hazy notion itself), and then want everything to be written in assembly. That's an interesting kind of first year students... The kind I know flee before anything lower than C++.
- chipotle_coyote 9y ago> Because it's an easy indicator of someone who has no idea what they're doing in OS development. From appearances, the lead "someone" on at least the kernel appears to be Travis Geiselbrecht, who worked at the OS and/or kernel level on BeOS, the Danger Hiptop (Sidekick) OS, his own NewOS (now the basis for HaikuOS), and an embedded OS at Jawbone before joining Google and starting work on LK, which is being used as the basis for Zircon and the Android bootloader. So I think maybe you mean > Because it's an easy indicator of someone who does not have the same opinions about OS development than I do. ...because, y'know, that's fine! But "this guy obviously has no idea what he's doing?" Gonna agree to disagree there.
- bitmapbrother 9y ago>Because it's an easy indicator of someone who has no idea what they're doing in OS development. Choosing the wrong tool for the job is meaningful. Have you ever looked through Chromium's C++ codebase? The same people are working on this and it tells us that they haven't learned their lesson. Have you looked into the backgrounds of the main developers working on Fuchsia OS? Because if you had you would have discovered that that they have a rather impressive resume who actually know what they're doing. Travis Geiselbrecht - BeOS, iOS, Hiptop OS, Little Kernel Brian Swetland - BeOS, Hiptop OS Chris McKillop - a member of the original iPhone team, WebOS, QNX OS, Hiptop OS
- Sir_Cmpwn 9y agoSomeone said something similar earlier, but I chose not to respond to avoid getting deeper into an unrelated argument. The short of it is that I don't find BeOS (and Haiku) particularly impressive. WebOS is all userspace and I don't really care how Fuschia's userspace looks, and I have to admit I don't know much about QNX or Hiptop.
- 2bitencryption 9y agoyou're right. it should be written in typescript. or maybe the java prerelease from 1995.
- mullsork 9y agoGet with the times. Clearly Rust is the answer!
- cat199 9y agoDid someone say pascal?
- jrimbault 9y agoUrg... https://externos.io/ https://externos.io/ Edit: >eXperience the future. I don't know what gets me more, the idea of a js os, the bad capitalization, the period at the end of a non sentence, the cliché expression...
- exikyut 9y agoWhoever's behind it seems to be stuck at the "gaussian blur compensates for all forms of design inexperience!!1" stage too.
- eddieh 9y agoAs someone who has dabbled in OS development over the years, you'd be a fool to use anything other than C (I suppose you could use a restricted subset of C++ if you really don't want to write anything but a toy OS) or assembly if you have something to prove.
- faitswulff 9y agoWhat about Rust disqualifies it? Let's say besides ecosystem immaturity (lack of libraries). As a non-systems programmer, I'm curious.
- throwaway78234 9y agoYou just provided at least two good reasons. Add the ABI instability as a third and rust has struck out.
- steveklabnik 9y agoOne drawback about Rust OSes right now is that they must use nightly Rust, and therefore, don't gain our stability guarantees. This is another form of immaturity. I still wish they would have done it anyway, but oh well :) On a technical level, there's nothing stopping you: we already have one serious project (Redox) and many, many hobby projects that exist.
- stusmall 9y agoThey do have some rust showing up in their repos. It looks like its mostly bindings needed to run rust on the OS. I don't know what their long term goals with it are. I'm guessing they want it for writing high performance user space daemons or whatever the fuchsia equivalent is. https://github.com/fuchsia-mirror?utf8=%E2%9C%93&q=&type=&language=rust https://github.com/fuchsia-mirror?utf8=%E2%9C%93&q=&type=&la...
- Sir_Cmpwn 9y agoNot OP but the reason I dislike Rust for OS/kernel development is that it's just too damn complicated. Kernels should be written in more conservative languages.
- aidenn0 9y agoI believe the kernel is based on L4, which has at least one bug-free implementation[1]. 1: http://sel4.systems/ http://sel4.systems/
- bitmapbrother 9y agoThe Ziron microkernel is based on Little Kernel[1]. One of the main authors of Fuchsia was the developer of LK. [1]https://github.com/littlekernel/lk/wiki/Introduction https://github.com/littlekernel/lk/wiki/Introduction
- aidenn0 9y agoThanks for the correction
- greenhouse_gas 9y agoJust want to point out that not that long ago redox-os (the microkernel OS in Rust) asked people to test it. People were able to kernel panic it, get privilege escalations, and DDoS it. In short, it had the same same issues a C based kernel would get. It's true that it's still heavily in development and doesn't offer any guarantees whatsoever, but I think that it should be pointed out that just because your language is good, doesn't mean that your end result will be good (and vice-versa, C based kernels like l4 and C based projects like SQLite have been formally verified (at least SQLite was verified after compilation, so they check for undefined language constructs.))
- peoplewindow 9y agoCan you link to that? I'd be curious to see how they did those things. I guess Redox has a lot of unsafe Rust code?
- dtolnay 9y agoHere is the "Redox Crash Challenge": https://github.com/redox-os/redox/issues/1136 https://github.com/redox-os/redox/issues/1136 According to the Redox book, at last count they had 70 cases of unsafe across 4500 total lines of kernel code. https://doc.redox-os.org/book/introduction/unsafes.html https://doc.redox-os.org/book/introduction/unsafes.html
- steveklabnik 9y agoSafe rust doesn’t mean “no bugs”, these kinds of issues aren’t inherently memory safety issues, they can also be the product of logic bugs.
- mercurial 9y agoWell, I mean, one of the issues listed is "getting a lockup with ls * on the default directory". Sure, Rust (or any other language, even something like Idris) is not a magic pill, but at that stage of development, you can't expect much. I would still say that it is, on average, a lot easier to shoot yourself in the foot in C than in Rust.