4 ms·

Yes, in ways that were learned over many years, by many people. Roll some of your own crypto, while you're at it.

aneutron 8y ago
Ain't nothing wrong with that /s What could possibly go wrong
simion314 8y ago
What is your point? My point is that if you nodejs you still are running "unsafe" C somewhere. Also what is the point of calling out on projects that are not using "cool" languages? You don't agree with the developer choice that is OK, probably that developer does not agree with your choice and has other priorities and if is an open source project probably he wants also to have fun while coding it.
- zeth___ 8y ago
  This isn't about cool this is about dangerous. C makes shooting yourself in the foot so easy and efficient it even asks for artillery support. The time and effort to secure a C program against malicious input is absolutely huge. It would be quicker to write a secure dsl that using raw C. Which brings us back to scripting languages that have that implemented already as a library you load to run your requests through.
  - potta_coffee 8y ago
    C lovers are downvoting you but you're entirely right.
- yorwba 8y ago
  The unsafe C in popular language runtimes has hopefully been written or at least reviewed by someone who knew what they were doing, and it presents a relatively controllable interface. Most people who write code in C are not that good at avoiding memory safety issues. The process is mostly to write some code, run it, then fix it until it doesn't crash immediately anymore. Have you ever been the first person to run valgrind on a codebase? Lots of uninitialized reads and use-after-free issues will be flagged, because they don't normally crash the program and therefore go undetected without using an additional checker. It can be fun to watch the error messages flow by, until you realize that now you have to file tickets for all of them. And some people won't even see the problem with those errors that don't crash the program, because potentially exploitable vulnerabilities are not as obviously bad as crashes.
  - simion314 8y ago
    I agree, but this does not mean that some experienced developers can't have some fun creating some tools in C, they may even be less buggy and more performant then some of the other tools written in high level languages. Btw, I am not a C fan, in fact I think I have no favorite language, I use what I have to for the project
ke29bnf 8y ago
Why did they also wrap them in new syntax and abstraction? Why not just build the ecosystem to do that and still have it all be “C”? Why not some fixes to the standard and update then old but useful code, and work on better compilers? This is what’s been confusing me for a while If you can write safe enough C for the core of an interpreted language, why not abstract that into tools and patterns that generate better, safer C and learn how to do that over the last 30 years Instead of JS and dozens of flavors, Python, ruby, lua... DRY right? My suspicion is “vanity projects generate a sense of novelty that’s easier to sell.” But if the OS and bulk of the stack are “C inside anyway” why the extra nonsense?

Ain't nothing wrong with that /s What could possibly go wrong

What is your point? My point is that if you nodejs you still are running "unsafe" C somewhere. Also what is the point of calling out on projects that are not using "cool" languages? You don't agree with the developer choice that is OK, probably that developer does not agree with your choice and has other priorities and if is an open source project probably he wants also to have fun while coding it.

zeth___ 8y ago
This isn't about cool this is about dangerous. C makes shooting yourself in the foot so easy and efficient it even asks for artillery support. The time and effort to secure a C program against malicious input is absolutely huge. It would be quicker to write a secure dsl that using raw C. Which brings us back to scripting languages that have that implemented already as a library you load to run your requests through.
- potta_coffee 8y ago
  C lovers are downvoting you but you're entirely right.
yorwba 8y ago
The unsafe C in popular language runtimes has hopefully been written or at least reviewed by someone who knew what they were doing, and it presents a relatively controllable interface. Most people who write code in C are not that good at avoiding memory safety issues. The process is mostly to write some code, run it, then fix it until it doesn't crash immediately anymore. Have you ever been the first person to run valgrind on a codebase? Lots of uninitialized reads and use-after-free issues will be flagged, because they don't normally crash the program and therefore go undetected without using an additional checker. It can be fun to watch the error messages flow by, until you realize that now you have to file tickets for all of them. And some people won't even see the problem with those errors that don't crash the program, because potentially exploitable vulnerabilities are not as obviously bad as crashes.
- simion314 8y ago
  I agree, but this does not mean that some experienced developers can't have some fun creating some tools in C, they may even be less buggy and more performant then some of the other tools written in high level languages. Btw, I am not a C fan, in fact I think I have no favorite language, I use what I have to for the project

ke29bnf 8y ago

Why did they also wrap them in new syntax and abstraction? Why not just build the ecosystem to do that and still have it all be “C”? Why not some fixes to the standard and update then old but useful code, and work on better compilers? This is what’s been confusing me for a while If you can write safe enough C for the core of an interpreted language, why not abstract that into tools and patterns that generate better, safer C and learn how to do that over the last 30 years Instead of JS and dozens of flavors, Python, ruby, lua... DRY right? My suspicion is “vanity projects generate a sense of novelty that’s easier to sell.” But if the OS and bulk of the stack are “C inside anyway” why the extra nonsense?