3 ms·
The interest in making languages safer, rather than in making code written in them safer, seems to have developed into a bigger factor recently than it was in t
by floatingatoll 8y ago
The interest in making languages safer, rather than in making code written in them safer, seems to have developed into a bigger factor recently than it was in the 90s. I can’t personally think of any not-Rust languages that prioritize operating safety over ease of coding (compared to Rust). Perl lets you rewrite the global interpreter at runtime, PHP enables decades-old code to continue running, Apple Basic offered PEEK and POKE for writing arbitrary bytes to anywhere addressable by the memory controller. I’m sure some exist, but my point is that we have been favoring expanded capabilities for decades and only now are we starting to favor expanded safeties. When taken in that light, it makes perfect sense that C++ has always wanted to expand the capabilities of C without caring about safeties. What else could have resulted from that history?
- steveklabnik 8y agoIn some sense. I’m not sure when “langsec” started, but it’s certainly older than rust.
- floatingatoll 8y agoWhile it is certainly true that Langsec has been around since we invented programming, Rust is the only viable language I’ve encountered in practical use anywhere that prioritizes langsec over ease-of-delivery. The focus of C++ on features rather than safeties is echoed by almost every language invented prior to Rust. (I don’t know why Rust was the agent of change in that priority, but I’m very glad for it!) EDIT: COBOL is good at this, or tries to be. Lots of loopholes but it’s clear from this article anyways that they tried to make it a safe language. But they prioritized features like “call arbitrary C functions” over safety, and you can just write unsafe code without even a hint that you’re doomed. That’s perhaps the essence of what I see as the difference: Rust forces you to declare your unsafe intentions to do unsafe things. https://www.kiuwan.com/blog/security-business-oriented-languages-cobol-rpg/ https://www.kiuwan.com/blog/security-business-oriented-langu...
- steveklabnik 8y ago> (I don’t know why Rust was the agent of change in that priority, but I’m very glad for it!) Mozilla did an analysis of security bugs in Firefox and many of them were memory safety issues. That’s part why they sponsored it, at least.
- renox 8y agoStrange claim, have you ever heard about Ada?
- floatingatoll 8y agoYes.
- thequux 8y agoLangsec as in "the root of (many) vulnerabilities is bad input handling, leading to parse tree differentials" started in ~2007 with Meredith Patterson's Dejector. This research led to using actual parsing frameworks everywhere and, in fact, directly inspired nom. However, this doesn't have much to do with the languages themselves being safe. That research is very old; Ada was an early attempt to tighten-down type systems for safer code, and I'm sure that even that had precedent.
- steveklabnik 8y agoYeah, it's certainly bigger than just that idea; it was just the first thing that came to mind as something older than Rust.