3 ms·

>(For the same reason, I want the standards committee to produce a bounds-checked dialect of C where I can choose to pay some perf cost to get real dynamic and

by nokcha 8y ago

>(For the same reason, I want the standards committee to produce a bounds-checked dialect of C where I can choose to pay some perf cost to get real dynamic and bounds-checked arrays) The Checked C project is working on such a bounds-checked dialect of C: https://www.microsoft.com/en-us/research/project/checked-c/ https://www.microsoft.com/en-us/research/project/checked-c/

kartickv 8y ago
In fact, I'd like my C compiler to use bounds-checked arrays by default, with an option to disable it in performance-critical code. Safe by default, performant only when needed. That's the only way to build secure software. Since nothing in the C language prohibits bounds-checking for arrays, we can retrofit this to existing insecure languages rather than forcing all programmers to rewrite their software in some other language, which realistically won't happen for a decade or longer.
- yoklov 8y ago
  IIRC https://cyclone.thelanguage.org/ https://cyclone.thelanguage.org/ did this (among other things -- I think it's also where Rust lifetimes began their, err, life) and ended up having rather poor performance for pointer-manipulation heavy code. I don't know if things would be better now with more optimizing compilers, but I remember being somewhat surprised by this at the time, since you'd expect most of the overhead from passing fat pointers around to get optimized away.
  - kartickv 8y ago
    Did Cyclone let you turn off bounds-checking in performance-critical code, as I suggested?
- pjmlp 8y ago
  AT&T made Cyclone as C replacement, GCC has an extension for decades, MSVC++ has had pointer coherency debug libraries, SPARC has hardware validation for pointers. There are many other examples of people trying to band aid and improve C's security history. The biggest problem is that the developers that are supposed to actually adopt those practices don't really care, because performance trumps security. Those that actually care end up moving to C++, or some other language, so we end up with this selection bias. Thankfully they are being forced to change, as being 100% connected to the Internet does wonders to security.
  - kartickv 8y ago
    Interesting. Regarding developers not caring about security, that's why I suggested it should be the default, with an option to turn it off for performance or other reasons, rather than the other way around.
    - pjmlp 8y ago
      Agreed, however that is against the culture of those that decide to stick with C no matter what. Secure by default with option to turn those features off for performance, has been the way other systems programming languages have been designed since 1961. That C culture is now being forced to change, because fixing memory corruption CVEs in devices that are permanently under security exploits attacks does not scale.
      - kartickv 8y ago
        Interesting perspective; thanks for sharing.

by nokcha 8y ago

kartickv 8y ago

In fact, I'd like my C compiler to use bounds-checked arrays by default, with an option to disable it in performance-critical code. Safe by default, performant only when needed. That's the only way to build secure software. Since nothing in the C language prohibits bounds-checking for arrays, we can retrofit this to existing insecure languages rather than forcing all programmers to rewrite their software in some other language, which realistically won't happen for a decade or longer.

yoklov 8y ago
IIRC https://cyclone.thelanguage.org/ https://cyclone.thelanguage.org/ did this (among other things -- I think it's also where Rust lifetimes began their, err, life) and ended up having rather poor performance for pointer-manipulation heavy code. I don't know if things would be better now with more optimizing compilers, but I remember being somewhat surprised by this at the time, since you'd expect most of the overhead from passing fat pointers around to get optimized away.
- kartickv 8y ago
  Did Cyclone let you turn off bounds-checking in performance-critical code, as I suggested?
pjmlp 8y ago
AT&T made Cyclone as C replacement, GCC has an extension for decades, MSVC++ has had pointer coherency debug libraries, SPARC has hardware validation for pointers. There are many other examples of people trying to band aid and improve C's security history. The biggest problem is that the developers that are supposed to actually adopt those practices don't really care, because performance trumps security. Those that actually care end up moving to C++, or some other language, so we end up with this selection bias. Thankfully they are being forced to change, as being 100% connected to the Internet does wonders to security.
- kartickv 8y ago
  Interesting. Regarding developers not caring about security, that's why I suggested it should be the default, with an option to turn it off for performance or other reasons, rather than the other way around.
  - pjmlp 8y ago
    Agreed, however that is against the culture of those that decide to stick with C no matter what. Secure by default with option to turn those features off for performance, has been the way other systems programming languages have been designed since 1961. That C culture is now being forced to change, because fixing memory corruption CVEs in devices that are permanently under security exploits attacks does not scale.
    - kartickv 8y ago
      Interesting perspective; thanks for sharing.