11 ms·

Zig: software should be perfect [video]

218 points by luu 8y ago

justicezyx 8y ago
Oh come on, we already know that logical systems cannot even self reconcile it's own promises, as Gödel proved, now someone claim software should be perfect?! Edit: the original title does not mention perfect.
- TaylorAlexander 8y ago
  Yeah. Original title is “Zig: A programming language designed for robustness, optimality, and clarity – Andrew Kelley” and “Software should be perfect” is much more sensational.
  - luu 8y ago
    If you look at the video, you'll see that "Software Should Be Perfect" is the title slide of the talk (you don't even have to click play, it's there at the start). And then the first words out of the speaker's mouth (other than a sound check) are "I'm going to try to convince all you that software should be perfect". The "original title" you're referring to is what the person who uploaded the talk to youtube titled the talk, not what the speaker titled the talk.
    - porphyrogene 8y ago
      Questioning if someone read the article or, in this case, watched the video is against the Hacker News guidelines. If you feel a commenter is not fully engaged with the topic you should decline to continue the thread.
      - notacoward 8y ago
        Meta-discussion is also against the guidelines. Being a rules lawyer is bad enough; don't be a rules hypocrite. P.S. Yes, I know I'm also engaged in meta-discussion now. I can afford it.
    - tom_mellior 8y ago
      The "original title" is also what this video was posted as five months ago and discussed here: https://news.ycombinator.com/item?id=17184407 https://news.ycombinator.com/item?id=17184407
- audunw 8y ago
  Come on, a title like that isn’t meant to be taken too seriously. And you’re reaching a bit far. You can write a perfect function that adds two 32 bit integers. There is a subset of code that can be written perfectly. Especially if you don’t need Turing completeness to write it. Zig just tries it’s best to make it easy to write as much as possible of low level code in a perfect way.
  - jcelerier 8y ago
    > You can write a perfect function that adds two 32 bit integers. how ? the problem of adding two 32 bits integers is itself imperfect since you may at some point have big integers to sum, so any solution is inherently flawed, too
    - mathgladiator 8y ago
      Simple, operate in the appropriate mathematical ring. Just because there is overflow doesn't mean it failed.
    - int_19h 8y ago
      The problem can be perfect depending on how it's stated. If you spell out the contract right, then it can be perfect. Some examples: Given two 32-bit signed integers, produce a 32-bit signed integer that is a sum of the inputs; if the sum doesn't fit into 32 bits, wrap modulo 32 bits. Given two 32-bit signed integers, produce a 64-bit signed integer that is a sum of the inputs. Given two 32-bit signed integers, produce either a 32-bit signed integer that is a sum of the inputs if it fits into 32 bits, or an error code indicating that it did not fit. The problem with languages like C is that they let you be imprecise and get away with in. If you just run with "add two signed 32-bit integers", and implement it as "x + y" in C, it will compile, and it will run, but the result is undefined behavior if it overflows (note: it doesn't even mean that you get the wrong value - it can literally do anything at all). In Zig, if you write it as "x + y", it will panic on overflow, which is at least well-defined and fails fast; and the language provides you with tools to implement any of the three properly defined scenarios above in straightforward ways (i.e. you can add with wraparound, or you can add with an overflow check).
- Ericson2314 8y ago
  Um, Gödel's incompleteness theorem is not a valid reason not to pursue formally verified software.
viach 8y ago
There is a typo in title in word "profit"
tomp 8y ago
So... the perfect programming language has error-prone manual memory management and rampant undefined behaviour (well at least it can build the code to crash instead of “nasal deamons”)? Yeah right.
- deleted 8y ago
  [deleted]
- c3534l 8y ago
  No one said the language was perfect. The language is to help you write perfect cod which was immediately defined at the start as code which does not produce errors on any valid inputs.
  - tomp 8y ago
    Isn’t that by definition? After all, if the code produces an error, then obviously the inputs weren’t valid...
Tempest1981 8y ago
Definitely nice to have tools (compiler warnings, static analyzers) that can keep you from hurting yourself. Of course many projects don’t use them, for various reasons. I wonder: is turning on full compiler warnings, then fixing them - is it making my software better, or just satisfying some type of neuroticism?
- trustmath 8y ago
  It's not neurosis if it has a useful purpose.
  - porphyrogene 8y ago
    Is it useful if it makes no difference to the user?
    - muxator 8y ago
      Maybe it will make a big difference once the software is way into its useful life, and it needs to be maintained and evolved.
- clarry 8y ago
  There are stupid warnings about nothing to fix, at least in gcc. It's not making the software better. One warning I recently disabled on $workproject is -Wtrigraphs.
  - berti 8y ago
    Trigraphs can readily be formed unintentionally, so having a warning when they change the meaning of the program seems valuable. There is a good reason they were removed entirely in C++17.
    - clarry 8y ago
      They are as good as removed from C. No compiler I care about has had them enabled by default in more than two decades.
revskill 8y ago
Javascript (programming language) and Browser (runtime environment) is a perfect piece of combination. With JS, you have many choices of implementation. With Browser, runtime error doesn't crash user's device.
- nerdponx 8y ago
  Same is true for the JVM or Python, no?
  - Ace17 8y ago
    Yeah. BTW it's also true for native apps running in user-mode.
- pshc 8y ago
  Browsers are far from perfect but their sandboxes are getting pretty good. I think you typoed WebAssembly though?
- clockbolder 8y ago
  Uhh.. wait, what?
- viraptor 8y ago
  > With Browser, runtime error doesn't crash user's device. There's a large number of JS bugs and sandbox escapes in all browsers. They certainly can crash the user device.
perlgeek 8y ago
There's a certain irony that the presenter quickly dismisses exception-based error handling, and then the first example handles an error by printing a message and exiting -- exactly what an unhandled exception does. This is more than a small piece of irony with a somewhat artificial example. Often, there simply isn't very much you can do with an error. In a SaaS world, you might not be able to tell the user what wrong, in order to not disclose some private information. You can log the error, but only if the network is available, and you can only log it to disk if the disk isn't full. And then there are cases where you could try to explain the error to the user, but the reasons are very complicated and/or require intimate knowledge of the architecture to make sense, and/or require intimate subject knowledge to understand, or even obscure legal reasons.
- AndyKelley 8y ago
  I made this argument in the talk: the only problem with exception-based handling is the lack of explicitness. It's too easy to call functions without being aware of the set of possible errors. Many c++ projects disable exceptions entirely. Writing "exception safe" code is tricky and non-obvious. Functions which should be guaranteed to never fail often can throw std::bad_alloc. Try-catch syntax forces incorrect nesting. Related: Only zig has fast errors with traces. Other languages have no traces or a high performance cost. Look up error return traces in the docs.
  - bluejekyll 8y ago
    > Related: Only zig has fast errors with traces. Other languages have no traces or a high performance cost. Look up error return traces in the docs. Out of curiosity, have you compared this to Rust’s backtrace mechanism? I’d be interested in the perf difference, if it’s available.
    - dbaupp 8y ago
      Rust's panics and their backtrackes are essentially the same as C++ exceptions.
loeg 8y ago
Re: performance claims, I wonder if the C sha256 implementation would have been more competitive with -march=native -mtune=native?
- tom_mellior 8y ago
  I think it would. I posted some observations on this the last time this video was discussed: https://news.ycombinator.com/item?id=17187140 https://news.ycombinator.com/item?id=17187140 My hypothesis is that Zig's compiler passes the equivalent of -march=native to the backend, which is why it should also be given to the C compiler to give a fair comparison (and a speedup of 30% or so).
  - AndyKelley 8y ago
    I think you are probably right. I will do a follow-up post addressing the performance claims in this talk. I think I owe it to the community.
    - loeg 8y ago
      Much appreciated. Given Zig's design and use of LLVM, for code translated "line by line" (same algorithm) I don't see any reason for Zig's performance not to be substantially identical to C (compiled with Clang). It wouldn't surprise me if there are reasons Zig can do better or makes it easier to use better algorithms, etc, but you wouldn't expect that to show up in something as computationally straightforward as a cryptographic primitive. By the way, as a C practitioner, I'm a fan of what you're doing with Zig; keep it up! C++, Go, and Rust don't appeal to me for all of the reasons mentioned in your talk.
- Avamander 8y ago
  Why isn't `-march=native -mtune=native` enabled by-default for every piece of software compiled unless explicitly specified otherwise?
  - loeg 8y ago
avip 8y ago
It is actually a nice informative video, but the title is as dumb as dumbness itself. Software should not be perfect. It should be useful. In places where perfection increases usefulness (s.a autopilot), go ahead make it perfect. In most cases, striving for "perfection" is a profound misallocation of resources.
- dj-wonk 8y ago
  Upvoted since this is a useful comment and worth mentioning. I'd expect some downvotes are based on negative reactions to this part of the comment: "the title is as dumb as dumbness itself." (Dear avip: if your comment said "the title is off-base" you would have made your point just as effectively and without the downvotes.)
  - avip 8y ago
    Thanks, I really appreciate that (the message, not the upvote).
- vortico 8y ago
  Yes, it gives the impression that the author thinks memory allocation errors are the only type of bug. Obviously there are thousands more, so it's kind of odd.
  - dj-wonk 8y ago
    Well said. There are many kinds of behavior that may be considered "out of specification" or not adhering to a contract. Here are just four: * https://en.wikipedia.org/wiki/Undefined_behavior https://en.wikipedia.org/wiki/Undefined_behavior * https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack * https://en.wikipedia.org/wiki/Thread_safety https://en.wikipedia.org/wiki/Thread_safety * https://en.wikipedia.org/wiki/Privilege_escalation https://en.wikipedia.org/wiki/Privilege_escalation Some of these probably don't come to everyone's minds right away. Please share your favorites. The behavior(s) that a particular language guarantees is a design question. Once those guarantees are specified, we can objectively evaluate a particular language in terms of how well it does according to its own standards.
mschwaig 8y ago
The definition of 'perfect software' used in the talk is 'it gives you the correct output for every input in the input domain'. To that end no funny business like hidden allocations or hidden control flow should happen behind your back, because an out of memory error or some exception your code does not deal with explicitly would not be a correct output according to that definition. Of course you do not need that level of control for most projects.
- electrograv 8y ago
  While I agree with the content of your post literally, I think we often underestimate the importance of software reliability and performance, and end up giving it less attention than it deserves. I understand the place for rapid prototyping etc., and that not every software application deals with life-and-death situations — but even those that aren’t, I think our industry suffers a bit here. For example, to this day the Windows 10 start menu refuses to open sometimes (randomly) when I click on it, even multiple times. You could argue that this isn’t a huge deal, because within 30 seconds it usually “fixes itself” (or something like that), but it still doesn’t shake the overall feeling that we’re tolerating way too much shoddy software in 2018 than we should. Or in terms of performance: I know not every application needs bare-to-the-metal speed, but something feels wrong with the world when my “supercomputer” (compared to a 1990s PC, for example) literally lags when I’m typing or scrolling in some apps, when a 1990s era PC could respond to essentially the same content interaction with almost zero latency. Some few decades ago, we had far more klunkier programming languages, far slower hardware, and yet somehow yielded better tangible/functional results in some cases. Therefore, I’m very much in favor of anything that moves us towards higher quality software, and Zig (and Rust, and others) are all exciting examples of that.
  - bjourne 8y ago
    It is entirely possible that even if Windows 10 was perfect software according to the "it gives you the correct output for every input in the input domain" definition, it would still not open the start menu every time you clicked on the icon.
deleted 8y ago
[deleted]
visualstudio 8y ago
I'm watching Zig and Jai closely. We need a better C and C++ isn't it. Good luck!
- electrograv 8y ago
  I honestly think Zig has the potential to be the C/C++ replacement. I haven’t checked out Jai yet but will now that you mention, thanks! This is somewhat subjective of course, but from what I’ve seen, Zig has just the right set of features to modernize systems programming, without making the language too complex or difficult to write (which arguably Rust’s “borrow checker” system does), and (like Rust) gets rid of some huge legacy language design mistakes most people agree on today (e.g. nullable-by-default pointer types, or no way to know at compile time or at a glance what range of exceptions a function may throw). And of course, the “automatic” interoperability with C is an essential part of any C/C++ replacement contender.
  - Jach 8y ago
    There are a lot of contenders. My own unsorted list is Nim, Rust, C++20xx, D, Objective C, Pony, Zig, Crystal, Red, and maybe a form of Lisp (why not Common Lisp). Even more unlikely a maybe and only for the C/C++ trenches of embedded systems, some form of Forth. If Jai ever ships I might consider adding it (at least as a contender to the C/C++ trenches of games and game engines), but it's absurd to think it will have any impact when it can't even be used by anyone other than jblow yet. Even if it ships, I would bet its highest anywhere-realistic impact (which is still damn high) would be to become the PHP of game programming. The mythical C/C++ replacement that everyone will choose when they previously would have chosen C or C++, causing C/C++ to die like COBOL? Much less likely.
    - electrograv 8y ago
      Many of those are ruled out as modern successors (in my mind, at least), when they continue to make “the billion dollar mistake” (to use its inventor’s own words[1]) of null references. Rust, Zig, Kotlin, Swift, and many other modern languages can express the same concept of a null reference, but in a fundamentally superior way. In modern languages like these, the compiler will statically guarantee the impossibility of null dereference exceptions, without negatively impacting performance or code style! But it goes beyond just static checking. It makes coding easier, too: You will never have to wonder whether a function returning a reference might return null on a common failure, vs throw an exception. You’ll never have to wonder if an object reference parameter is optional or not, because this will be explicit in the data type accepter/returned. You’ll never have to wonder if this variable of type T in fact contains a valid T value, or actually is just “null”, because the possible range of values will be encoded in the type system: If it could be null, you’ll know it and so will the compiler. Not only is this better for safety (the compiler won’t let you do the wrong thing), it’s self-documenting. It blows my mind that any modern language design would willingly think nullable object references is still a good idea (or perhaps its out of ignorance), when there are truly zero-cost solutions to this — in both runtime performance and ease of writing code, as you can see for example from Zig or Kotlin. [1] https://www.infoq.com/presentations/Null-References-The-Billion-Dollar-Mistake-Tony-Hoare https://www.infoq.com/presentations/Null-References-The-Bill...
ajennings 8y ago
I've wanted a language like this. Java's checked exceptions with some way to offload the bookkeeping to the compiler. What about other run-time exceptions, like divide by zero? Are they checked? What about Hoare's billion-dollar mistake (null pointer exceptions)? Does Zig have non-nullable references?
- AndyKelley 8y ago
  Zig has a bunch of runtime safety checking. It applies to divide by zero as well as integer overflow, using the wrong union field, and many more. The runtime safety checks are enabled in Debug and ReleaseSafe mode and disabled in ReleaseFast and ReleaseSmall mode. (Actually they are used as assertions to the optimizer so that it can rely on extra stuff being undefined behavior.) Pointers can not be null. However you can have optional pointers which are guaranteed to use the 0x0 value as null and have the same size as normal pointers.
- deleted 8y ago
  [deleted]
throwaway487548 8y ago
Many very bright people in the major sects of ML and Scheme tried to achieve perfection, and they have concluded, many times, that perfection implies a mostly-functional strongly (and, perhaps, even statically typed but with optional annotations only, like it is in Haskell) language, possibly with uniform pattern-matching, annotated laziness, and high-order channels, and select and receive in the language itself. Such a language could be visualized as strict-by-default Haskell (with type-classes, uniform pattern-matching, minimalist syntax - everything, except monads) plus ideas from Erlang, Go and Ocaml. Perfection and imperativeness, it seems, does not match.
- vortico 8y ago
  Also, perfection and practicality do not match either, since imperative languages are the most practical for many applications. Pushing software toward perfection gives diminishing returns, and after some threshold, a company will have negative profit due to expensive development costs.
  - throwaway487548 8y ago
    ML is very practical. The only reasons why it did not became popular (or has not been chosen as, say, the basis for Java) are social rather than technical and actually are insults to intelligence.
gbuk2013 8y ago
From the video: > Documentation is about 80% done And yet there is not standard library documentation. :( https://github.com/ziglang/zig/issues/965 https://github.com/ziglang/zig/issues/965

218 points by luu 8y ago

Oh come on, we already know that logical systems cannot even self reconcile it's own promises, as Gödel proved, now someone claim software should be perfect?! Edit: the original title does not mention perfect.

TaylorAlexander 8y ago
Yeah. Original title is “Zig: A programming language designed for robustness, optimality, and clarity – Andrew Kelley” and “Software should be perfect” is much more sensational.
- luu 8y ago
  If you look at the video, you'll see that "Software Should Be Perfect" is the title slide of the talk (you don't even have to click play, it's there at the start). And then the first words out of the speaker's mouth (other than a sound check) are "I'm going to try to convince all you that software should be perfect". The "original title" you're referring to is what the person who uploaded the talk to youtube titled the talk, not what the speaker titled the talk.
  - porphyrogene 8y ago
    Questioning if someone read the article or, in this case, watched the video is against the Hacker News guidelines. If you feel a commenter is not fully engaged with the topic you should decline to continue the thread.
    - notacoward 8y ago
      Meta-discussion is also against the guidelines. Being a rules lawyer is bad enough; don't be a rules hypocrite. P.S. Yes, I know I'm also engaged in meta-discussion now. I can afford it.
  - tom_mellior 8y ago
    The "original title" is also what this video was posted as five months ago and discussed here: https://news.ycombinator.com/item?id=17184407 https://news.ycombinator.com/item?id=17184407
audunw 8y ago
Come on, a title like that isn’t meant to be taken too seriously. And you’re reaching a bit far. You can write a perfect function that adds two 32 bit integers. There is a subset of code that can be written perfectly. Especially if you don’t need Turing completeness to write it. Zig just tries it’s best to make it easy to write as much as possible of low level code in a perfect way.
- jcelerier 8y ago
  > You can write a perfect function that adds two 32 bit integers. how ? the problem of adding two 32 bits integers is itself imperfect since you may at some point have big integers to sum, so any solution is inherently flawed, too
  - mathgladiator 8y ago
    Simple, operate in the appropriate mathematical ring. Just because there is overflow doesn't mean it failed.
  - int_19h 8y ago
    The problem can be perfect depending on how it's stated. If you spell out the contract right, then it can be perfect. Some examples: Given two 32-bit signed integers, produce a 32-bit signed integer that is a sum of the inputs; if the sum doesn't fit into 32 bits, wrap modulo 32 bits. Given two 32-bit signed integers, produce a 64-bit signed integer that is a sum of the inputs. Given two 32-bit signed integers, produce either a 32-bit signed integer that is a sum of the inputs if it fits into 32 bits, or an error code indicating that it did not fit. The problem with languages like C is that they let you be imprecise and get away with in. If you just run with "add two signed 32-bit integers", and implement it as "x + y" in C, it will compile, and it will run, but the result is undefined behavior if it overflows (note: it doesn't even mean that you get the wrong value - it can literally do anything at all). In Zig, if you write it as "x + y", it will panic on overflow, which is at least well-defined and fails fast; and the language provides you with tools to implement any of the three properly defined scenarios above in straightforward ways (i.e. you can add with wraparound, or you can add with an overflow check).
Ericson2314 8y ago
Um, Gödel's incompleteness theorem is not a valid reason not to pursue formally verified software.

viach 8y ago

There is a typo in title in word "profit"

tomp 8y ago

So... the perfect programming language has error-prone manual memory management and rampant undefined behaviour (well at least it can build the code to crash instead of “nasal deamons”)? Yeah right.

deleted 8y ago
[deleted]
c3534l 8y ago
No one said the language was perfect. The language is to help you write perfect cod which was immediately defined at the start as code which does not produce errors on any valid inputs.
- tomp 8y ago
  Isn’t that by definition? After all, if the code produces an error, then obviously the inputs weren’t valid...

Tempest1981 8y ago

Definitely nice to have tools (compiler warnings, static analyzers) that can keep you from hurting yourself. Of course many projects don’t use them, for various reasons. I wonder: is turning on full compiler warnings, then fixing them - is it making my software better, or just satisfying some type of neuroticism?

trustmath 8y ago
It's not neurosis if it has a useful purpose.
- porphyrogene 8y ago
  Is it useful if it makes no difference to the user?
  - muxator 8y ago
    Maybe it will make a big difference once the software is way into its useful life, and it needs to be maintained and evolved.
clarry 8y ago
There are stupid warnings about nothing to fix, at least in gcc. It's not making the software better. One warning I recently disabled on $workproject is -Wtrigraphs.
- berti 8y ago
  Trigraphs can readily be formed unintentionally, so having a warning when they change the meaning of the program seems valuable. There is a good reason they were removed entirely in C++17.
  - clarry 8y ago
    They are as good as removed from C. No compiler I care about has had them enabled by default in more than two decades.

revskill 8y ago

Javascript (programming language) and Browser (runtime environment) is a perfect piece of combination. With JS, you have many choices of implementation. With Browser, runtime error doesn't crash user's device.

nerdponx 8y ago
Same is true for the JVM or Python, no?
- Ace17 8y ago
  Yeah. BTW it's also true for native apps running in user-mode.
pshc 8y ago
Browsers are far from perfect but their sandboxes are getting pretty good. I think you typoed WebAssembly though?
clockbolder 8y ago
Uhh.. wait, what?
viraptor 8y ago
> With Browser, runtime error doesn't crash user's device. There's a large number of JS bugs and sandbox escapes in all browsers. They certainly can crash the user device.

perlgeek 8y ago

There's a certain irony that the presenter quickly dismisses exception-based error handling, and then the first example handles an error by printing a message and exiting -- exactly what an unhandled exception does. This is more than a small piece of irony with a somewhat artificial example. Often, there simply isn't very much you can do with an error. In a SaaS world, you might not be able to tell the user what wrong, in order to not disclose some private information. You can log the error, but only if the network is available, and you can only log it to disk if the disk isn't full. And then there are cases where you could try to explain the error to the user, but the reasons are very complicated and/or require intimate knowledge of the architecture to make sense, and/or require intimate subject knowledge to understand, or even obscure legal reasons.

AndyKelley 8y ago
I made this argument in the talk: the only problem with exception-based handling is the lack of explicitness. It's too easy to call functions without being aware of the set of possible errors. Many c++ projects disable exceptions entirely. Writing "exception safe" code is tricky and non-obvious. Functions which should be guaranteed to never fail often can throw std::bad_alloc. Try-catch syntax forces incorrect nesting. Related: Only zig has fast errors with traces. Other languages have no traces or a high performance cost. Look up error return traces in the docs.
- bluejekyll 8y ago
  > Related: Only zig has fast errors with traces. Other languages have no traces or a high performance cost. Look up error return traces in the docs. Out of curiosity, have you compared this to Rust’s backtrace mechanism? I’d be interested in the perf difference, if it’s available.
  - dbaupp 8y ago
    Rust's panics and their backtrackes are essentially the same as C++ exceptions.

loeg 8y ago

Re: performance claims, I wonder if the C sha256 implementation would have been more competitive with -march=native -mtune=native?

tom_mellior 8y ago
I think it would. I posted some observations on this the last time this video was discussed: https://news.ycombinator.com/item?id=17187140 https://news.ycombinator.com/item?id=17187140 My hypothesis is that Zig's compiler passes the equivalent of -march=native to the backend, which is why it should also be given to the C compiler to give a fair comparison (and a speedup of 30% or so).
- AndyKelley 8y ago
  I think you are probably right. I will do a follow-up post addressing the performance claims in this talk. I think I owe it to the community.
  - loeg 8y ago
    Much appreciated. Given Zig's design and use of LLVM, for code translated "line by line" (same algorithm) I don't see any reason for Zig's performance not to be substantially identical to C (compiled with Clang). It wouldn't surprise me if there are reasons Zig can do better or makes it easier to use better algorithms, etc, but you wouldn't expect that to show up in something as computationally straightforward as a cryptographic primitive. By the way, as a C practitioner, I'm a fan of what you're doing with Zig; keep it up! C++, Go, and Rust don't appeal to me for all of the reasons mentioned in your talk.
Avamander 8y ago
Why isn't `-march=native -mtune=native` enabled by-default for every piece of software compiled unless explicitly specified otherwise?
- loeg 8y ago

avip 8y ago

It is actually a nice informative video, but the title is as dumb as dumbness itself. Software should not be perfect. It should be useful. In places where perfection increases usefulness (s.a autopilot), go ahead make it perfect. In most cases, striving for "perfection" is a profound misallocation of resources.

dj-wonk 8y ago
Upvoted since this is a useful comment and worth mentioning. I'd expect some downvotes are based on negative reactions to this part of the comment: "the title is as dumb as dumbness itself." (Dear avip: if your comment said "the title is off-base" you would have made your point just as effectively and without the downvotes.)
- avip 8y ago
  Thanks, I really appreciate that (the message, not the upvote).
vortico 8y ago
Yes, it gives the impression that the author thinks memory allocation errors are the only type of bug. Obviously there are thousands more, so it's kind of odd.
- dj-wonk 8y ago
  Well said. There are many kinds of behavior that may be considered "out of specification" or not adhering to a contract. Here are just four: * https://en.wikipedia.org/wiki/Undefined_behavior https://en.wikipedia.org/wiki/Undefined_behavior * https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack * https://en.wikipedia.org/wiki/Thread_safety https://en.wikipedia.org/wiki/Thread_safety * https://en.wikipedia.org/wiki/Privilege_escalation https://en.wikipedia.org/wiki/Privilege_escalation Some of these probably don't come to everyone's minds right away. Please share your favorites. The behavior(s) that a particular language guarantees is a design question. Once those guarantees are specified, we can objectively evaluate a particular language in terms of how well it does according to its own standards.

mschwaig 8y ago

The definition of 'perfect software' used in the talk is 'it gives you the correct output for every input in the input domain'. To that end no funny business like hidden allocations or hidden control flow should happen behind your back, because an out of memory error or some exception your code does not deal with explicitly would not be a correct output according to that definition. Of course you do not need that level of control for most projects.

electrograv 8y ago
While I agree with the content of your post literally, I think we often underestimate the importance of software reliability and performance, and end up giving it less attention than it deserves. I understand the place for rapid prototyping etc., and that not every software application deals with life-and-death situations — but even those that aren’t, I think our industry suffers a bit here. For example, to this day the Windows 10 start menu refuses to open sometimes (randomly) when I click on it, even multiple times. You could argue that this isn’t a huge deal, because within 30 seconds it usually “fixes itself” (or something like that), but it still doesn’t shake the overall feeling that we’re tolerating way too much shoddy software in 2018 than we should. Or in terms of performance: I know not every application needs bare-to-the-metal speed, but something feels wrong with the world when my “supercomputer” (compared to a 1990s PC, for example) literally lags when I’m typing or scrolling in some apps, when a 1990s era PC could respond to essentially the same content interaction with almost zero latency. Some few decades ago, we had far more klunkier programming languages, far slower hardware, and yet somehow yielded better tangible/functional results in some cases. Therefore, I’m very much in favor of anything that moves us towards higher quality software, and Zig (and Rust, and others) are all exciting examples of that.
- bjourne 8y ago
  It is entirely possible that even if Windows 10 was perfect software according to the "it gives you the correct output for every input in the input domain" definition, it would still not open the start menu every time you clicked on the icon.

deleted 8y ago

[deleted]

visualstudio 8y ago

I'm watching Zig and Jai closely. We need a better C and C++ isn't it. Good luck!

electrograv 8y ago
I honestly think Zig has the potential to be the C/C++ replacement. I haven’t checked out Jai yet but will now that you mention, thanks! This is somewhat subjective of course, but from what I’ve seen, Zig has just the right set of features to modernize systems programming, without making the language too complex or difficult to write (which arguably Rust’s “borrow checker” system does), and (like Rust) gets rid of some huge legacy language design mistakes most people agree on today (e.g. nullable-by-default pointer types, or no way to know at compile time or at a glance what range of exceptions a function may throw). And of course, the “automatic” interoperability with C is an essential part of any C/C++ replacement contender.
- Jach 8y ago
  There are a lot of contenders. My own unsorted list is Nim, Rust, C++20xx, D, Objective C, Pony, Zig, Crystal, Red, and maybe a form of Lisp (why not Common Lisp). Even more unlikely a maybe and only for the C/C++ trenches of embedded systems, some form of Forth. If Jai ever ships I might consider adding it (at least as a contender to the C/C++ trenches of games and game engines), but it's absurd to think it will have any impact when it can't even be used by anyone other than jblow yet. Even if it ships, I would bet its highest anywhere-realistic impact (which is still damn high) would be to become the PHP of game programming. The mythical C/C++ replacement that everyone will choose when they previously would have chosen C or C++, causing C/C++ to die like COBOL? Much less likely.
  - electrograv 8y ago
    Many of those are ruled out as modern successors (in my mind, at least), when they continue to make “the billion dollar mistake” (to use its inventor’s own words[1]) of null references. Rust, Zig, Kotlin, Swift, and many other modern languages can express the same concept of a null reference, but in a fundamentally superior way. In modern languages like these, the compiler will statically guarantee the impossibility of null dereference exceptions, without negatively impacting performance or code style! But it goes beyond just static checking. It makes coding easier, too: You will never have to wonder whether a function returning a reference might return null on a common failure, vs throw an exception. You’ll never have to wonder if an object reference parameter is optional or not, because this will be explicit in the data type accepter/returned. You’ll never have to wonder if this variable of type T in fact contains a valid T value, or actually is just “null”, because the possible range of values will be encoded in the type system: If it could be null, you’ll know it and so will the compiler. Not only is this better for safety (the compiler won’t let you do the wrong thing), it’s self-documenting. It blows my mind that any modern language design would willingly think nullable object references is still a good idea (or perhaps its out of ignorance), when there are truly zero-cost solutions to this — in both runtime performance and ease of writing code, as you can see for example from Zig or Kotlin. [1] https://www.infoq.com/presentations/Null-References-The-Billion-Dollar-Mistake-Tony-Hoare https://www.infoq.com/presentations/Null-References-The-Bill...

ajennings 8y ago

I've wanted a language like this. Java's checked exceptions with some way to offload the bookkeeping to the compiler. What about other run-time exceptions, like divide by zero? Are they checked? What about Hoare's billion-dollar mistake (null pointer exceptions)? Does Zig have non-nullable references?

AndyKelley 8y ago
Zig has a bunch of runtime safety checking. It applies to divide by zero as well as integer overflow, using the wrong union field, and many more. The runtime safety checks are enabled in Debug and ReleaseSafe mode and disabled in ReleaseFast and ReleaseSmall mode. (Actually they are used as assertions to the optimizer so that it can rely on extra stuff being undefined behavior.) Pointers can not be null. However you can have optional pointers which are guaranteed to use the 0x0 value as null and have the same size as normal pointers.
deleted 8y ago
[deleted]

throwaway487548 8y ago

Many very bright people in the major sects of ML and Scheme tried to achieve perfection, and they have concluded, many times, that perfection implies a mostly-functional strongly (and, perhaps, even statically typed but with optional annotations only, like it is in Haskell) language, possibly with uniform pattern-matching, annotated laziness, and high-order channels, and select and receive in the language itself. Such a language could be visualized as strict-by-default Haskell (with type-classes, uniform pattern-matching, minimalist syntax - everything, except monads) plus ideas from Erlang, Go and Ocaml. Perfection and imperativeness, it seems, does not match.

vortico 8y ago
Also, perfection and practicality do not match either, since imperative languages are the most practical for many applications. Pushing software toward perfection gives diminishing returns, and after some threshold, a company will have negative profit due to expensive development costs.
- throwaway487548 8y ago
  ML is very practical. The only reasons why it did not became popular (or has not been chosen as, say, the basis for Java) are social rather than technical and actually are insults to intelligence.

gbuk2013 8y ago

From the video: > Documentation is about 80% done And yet there is not standard library documentation. :( https://github.com/ziglang/zig/issues/965 https://github.com/ziglang/zig/issues/965