6 ms·

This is C land. You're not going to make it far by making the case that bloat is acceptable. People have a range of technical and aesthetic reasons for hating

This is C land. You're not going to make it far by making the case that bloat is acceptable. People have a range of technical and aesthetic reasons for hating bloat and C attracts a lot of them. Off the top of my head: - Smaller memory footprints - Easier reimplementation - Lower attack surface - Less room for breaking changes - Less baggage for when we inevitably wish we could deprecate things

AceJohnny2 7y ago
> - Lower attack surface wut?
- Steven_Vellon 7y ago
  String formatting libraries, and other things that work with buffers are frequent attack surfaces for buffer overflow attacks. Granted, using C means developers often implement these operations themselves which introduces the possibility of creating more attack surfaces. But it's less likely that the standard library presents an attack surface when the standard library is tiny.
  - antirez 7y ago
    Actually not having dynamic strings and buffers in the library is one of the main reasons people do pointer math and reallocations by hand introducing memory corruption bugs.
  - AceJohnny2 7y ago
    I mean, C's attack surface is like that of activated charcoal. I'm not sure that C's small standard library gives it a smaller attack surface, specifically because it means programmers who have better things to do are forced to reinvent the wheel, poorly [1]. But mostly, because C's lack of guardrails means it takes active effort on even trivial operations to be safe. I've been working with it for nearly two decades, and every year I think more that C programs should be confined to a well-guarded quarantined area with hazard trefoils and a "beware of the leopard" sign. [1] https://en.wikipedia.org/wiki/Greenspun%27s_tenth_rule https://en.wikipedia.org/wiki/Greenspun%27s_tenth_rule edit: people reimplementing their "safe" string library isn't something to brag about, but be ashamed of our entire industry for.
einpoklum 7y ago
> Smaller memory footprints Nobody said you need to link the entire library. Plus - with custom-made libraries, the memory footprint is no smaller. > Easier reimplementation Implementation begins with some part of the standard library, and gets completed gradually later on. > Lower attack surface Are you really arguing in favor of "everyone roll your own library" as a reduction of attack surface? > Less room for breaking changes C's standard library was already broken in various significant ways to begin with (e.g. gets() ...) . Also, are you really worried about all those breaking changes between C99 and C11? > Less baggage for when we inevitably wish we could deprecate things Umm, you do realize things usually get deprecated when they've been replaced by something more relevant, right? In our case - new C library code.

AceJohnny2 7y ago

> - Lower attack surface wut?

Steven_Vellon 7y ago
String formatting libraries, and other things that work with buffers are frequent attack surfaces for buffer overflow attacks. Granted, using C means developers often implement these operations themselves which introduces the possibility of creating more attack surfaces. But it's less likely that the standard library presents an attack surface when the standard library is tiny.
- antirez 7y ago
  Actually not having dynamic strings and buffers in the library is one of the main reasons people do pointer math and reallocations by hand introducing memory corruption bugs.
- AceJohnny2 7y ago
  I mean, C's attack surface is like that of activated charcoal. I'm not sure that C's small standard library gives it a smaller attack surface, specifically because it means programmers who have better things to do are forced to reinvent the wheel, poorly [1]. But mostly, because C's lack of guardrails means it takes active effort on even trivial operations to be safe. I've been working with it for nearly two decades, and every year I think more that C programs should be confined to a well-guarded quarantined area with hazard trefoils and a "beware of the leopard" sign. [1] https://en.wikipedia.org/wiki/Greenspun%27s_tenth_rule https://en.wikipedia.org/wiki/Greenspun%27s_tenth_rule edit: people reimplementing their "safe" string library isn't something to brag about, but be ashamed of our entire industry for.

einpoklum 7y ago

> Smaller memory footprints Nobody said you need to link the entire library. Plus - with custom-made libraries, the memory footprint is no smaller. > Easier reimplementation Implementation begins with some part of the standard library, and gets completed gradually later on. > Lower attack surface Are you really arguing in favor of "everyone roll your own library" as a reduction of attack surface? > Less room for breaking changes C's standard library was already broken in various significant ways to begin with (e.g. gets() ...) . Also, are you really worried about all those breaking changes between C99 and C11? > Less baggage for when we inevitably wish we could deprecate things Umm, you do realize things usually get deprecated when they've been replaced by something more relevant, right? In our case - new C library code.