6 ms·

C++ features don’t help when you’re programming in straight C, as the article advises.

by kd5bjo 7y ago

pjmlp 7y ago
Other than UNIX like kernels and tiny PIC micro-controllers no one else should still be programming in straight C in 21st century.
- jstimpfle 7y ago
  If people choose to and it gives them joy, and they are productive and even learn valuable things, why not let them be?
  - pjmlp 7y ago
    Because if someone else happens to use that library, it might blow up on their face, e.g. WhatsApp dependency on android-gif-drawable. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11932 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1193...
    - deleted 7y ago
      [deleted]
    - jstimpfle 7y ago
      Are you looking for a safe way to use your computer? Turn it off. Other than that, I'm not surprised the file in question is C. Even ignoring the fact that it was you to get the link. And even ignoring that it's about a security problem... Other than that, from a user perspective, software written in C is among the most reliable software I'm using. I'm looking at Linux, vim, xterm and so much of the infrastructure that I don't even know by name. Some people value "security" more than they value the beauty of a nice, a maintainable, or a practical program. That's ok as far as I'm concerned...
      - pjmlp 7y ago
        The guys attending the Linux Kernel Security Summit seem to think otherwise, plenty of stuff there to entertain yourself.
        jstimpfle 7y ago
        Sure there is. But never be blinded, Linux is very performant and rock solid from an end user's viewpoint. Sometimes it helps putting things into perspective.
        pjmlp 7y ago
        Indeed, https://msrc-blog.microsoft.com/2019/06/14/prevent-the-impact-of-a-linux-worm-by-updating-exim-cve-2019-10149/ https://msrc-blog.microsoft.com/2019/06/14/prevent-the-impac... https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html https://security.googleblog.com/2019/08/adopting-arm-memory-... https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Work https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr... Seatbelts and helmets are also a nuisance, maybe we should get rid of them, that is my perspective.
        jstimpfle 7y ago
        If you like random links, here is another one... https://news.ycombinator.com/item?id=21741504 https://news.ycombinator.com/item?id=21741504
        pjmlp 7y ago
        The difference being that my links have to do with damage C keeps bringing into IT and the respective monetary losses. They are not random, only to those that don't care about improving the quality of our eco-system. Software liability couldn't come soon enough.
        jstimpfle 7y ago
- kd5bjo 7y ago
  That may be so, but the central thesis of the article is that C is the still the appropriate language in which to write libraries for interoperation. If you believe otherwise, I suspect that a rebuttal of the author’s arguments in favor of C would be well-received as a top-level comment here— there seem to be a lot of people that agree with you, but nobody has yet stated why they hold that opinion.
  - Const-me 7y ago
    > but nobody has yet stated why they hold hat opinion. I did, in my first comment. C++ namespaces lead to much more readable code, compared to these prefixed names. C++/11 scoped enums eliminate a class of bugs: when you have many different constants on the API surface, multiple functions accepting them, and erroneously use the constant of a wrong function. Example: enum Lod { Low, High }; enum SomethingElse { Other }; void setLoD( enum Lod v ); void bug() { setLoD( Other ); }
    - kd5bjo 7y ago
      Especially with this expanded commentary, you do show some advantages of C++ over C, but you have only addressed the advice for how to proceed once you’ve chosen C and not the author’s reasons for preferring C to C++ (or any other language): — Every language out there has a way to call into C — If your code is slower than C, someone will rewrite it in C. — If your library is written in C it means it can be used on any OS, console or mobile device and even on the web. — Not everyone wants to use C++ (some prefer C). — It is easier in general for a C++ user to use a C library than it is for a C user to use a C++ library. — C++ is not as easy to write wrappers for in other languages. — Unless you limit which C++ features you use (to the point where you are pretty much left with C) a lot of people won’t be able to use your library. PS. If your original comment had been phrased the way you put it here I might have made the same comment, but I would not have downvoted it. Here, you’re at least providing some supporting evidence for your assertions which makes it a much more valuable contribution to the conversation.
      - Const-me 7y ago
- starsinspace 7y ago
  I agree that "straight C" is not the best choice anymore... but C++ isn't great either. It inherits most of C's weaknesses and for libraries, it makes it very difficult to use the code from languages other than C++. By making a library in C++ you are basically limiting it to being used only in C++ projects. (Yes, wrapper generators for C++-to-whatever exist, but my experience with using e.g. Qt from other languages has always been pretty terrible). Even in 2019, the C ABI is the one universally agreed-upon cross-language ABI for languages compiled to native code.
  - pjmlp 7y ago
    In what concerns security, both should be nuked. However given that at least C++ does support ways to tame C, after all the whole purpose was for Bjarne never to repeat his Simula into BCPL rewrite experience ever again, it is up for security conscious to decide what legacy they want to leave, when the option is between both those languages. On the other hand maybe C should be used to write Skynet, so that we stand a chance.
- huhtenberg 7y ago
  Reading through your comments the only take-away appears to be that you just really don't like C for whatever reason. C is a perfectly fine language for tasks of all kinds. The fact that it expects programmers to take greater care when using it is not a reason enough to dismiss it as a general-purpose language. Not everyone needs (or wants) to ride a tricycle wearing knee pads and a helmet to get from A to B.
  - pjmlp 7y ago
    Ah the old straight jacket argument against computer security, never gets old. The reason is very simple, the billions of wasted money fixing security exploits caused by industry's adoption of C. Morris worm is more than 30 years old, and the old ways can still be used to attack modern systems that people insist in writing using C. https://msrc-blog.microsoft.com/2019/06/14/prevent-the-impact-of-a-linux-worm-by-updating-exim-cve-2019-10149/ https://msrc-blog.microsoft.com/2019/06/14/prevent-the-impac... https://support.apple.com/en-us/HT210348 https://support.apple.com/en-us/HT210348 https://msrc-blog.microsoft.com/2019/07/16/a-proactive-approach-to-more-secure-code/ https://msrc-blog.microsoft.com/2019/07/16/a-proactive-appro... https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Work https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr... https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html https://security.googleblog.com/2019/08/adopting-arm-memory-...

C++ features don’t help when you’re programming in straight C, as the article advises.

by kd5bjo 7y ago

C++ features don’t help when you’re programming in straight C, as the article advises.

Other than UNIX like kernels and tiny PIC micro-controllers no one else should still be programming in straight C in 21st century.

jstimpfle 7y ago
If people choose to and it gives them joy, and they are productive and even learn valuable things, why not let them be?
- pjmlp 7y ago
  Because if someone else happens to use that library, it might blow up on their face, e.g. WhatsApp dependency on android-gif-drawable. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11932 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1193...
  - deleted 7y ago
    [deleted]
  - jstimpfle 7y ago
    Are you looking for a safe way to use your computer? Turn it off. Other than that, I'm not surprised the file in question is C. Even ignoring the fact that it was you to get the link. And even ignoring that it's about a security problem... Other than that, from a user perspective, software written in C is among the most reliable software I'm using. I'm looking at Linux, vim, xterm and so much of the infrastructure that I don't even know by name. Some people value "security" more than they value the beauty of a nice, a maintainable, or a practical program. That's ok as far as I'm concerned...
    - pjmlp 7y ago
      The guys attending the Linux Kernel Security Summit seem to think otherwise, plenty of stuff there to entertain yourself.
      - jstimpfle 7y ago
        Sure there is. But never be blinded, Linux is very performant and rock solid from an end user's viewpoint. Sometimes it helps putting things into perspective.
        pjmlp 7y ago
        Indeed, https://msrc-blog.microsoft.com/2019/06/14/prevent-the-impact-of-a-linux-worm-by-updating-exim-cve-2019-10149/ https://msrc-blog.microsoft.com/2019/06/14/prevent-the-impac... https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html https://security.googleblog.com/2019/08/adopting-arm-memory-... https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Work https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr... Seatbelts and helmets are also a nuisance, maybe we should get rid of them, that is my perspective.
        jstimpfle 7y ago
        If you like random links, here is another one... https://news.ycombinator.com/item?id=21741504 https://news.ycombinator.com/item?id=21741504
        pjmlp 7y ago
        The difference being that my links have to do with damage C keeps bringing into IT and the respective monetary losses. They are not random, only to those that don't care about improving the quality of our eco-system. Software liability couldn't come soon enough.
        jstimpfle 7y ago
kd5bjo 7y ago
That may be so, but the central thesis of the article is that C is the still the appropriate language in which to write libraries for interoperation. If you believe otherwise, I suspect that a rebuttal of the author’s arguments in favor of C would be well-received as a top-level comment here— there seem to be a lot of people that agree with you, but nobody has yet stated why they hold that opinion.
- Const-me 7y ago
  > but nobody has yet stated why they hold hat opinion. I did, in my first comment. C++ namespaces lead to much more readable code, compared to these prefixed names. C++/11 scoped enums eliminate a class of bugs: when you have many different constants on the API surface, multiple functions accepting them, and erroneously use the constant of a wrong function. Example: enum Lod { Low, High }; enum SomethingElse { Other }; void setLoD( enum Lod v ); void bug() { setLoD( Other ); }
  - kd5bjo 7y ago
    Especially with this expanded commentary, you do show some advantages of C++ over C, but you have only addressed the advice for how to proceed once you’ve chosen C and not the author’s reasons for preferring C to C++ (or any other language): — Every language out there has a way to call into C — If your code is slower than C, someone will rewrite it in C. — If your library is written in C it means it can be used on any OS, console or mobile device and even on the web. — Not everyone wants to use C++ (some prefer C). — It is easier in general for a C++ user to use a C library than it is for a C user to use a C++ library. — C++ is not as easy to write wrappers for in other languages. — Unless you limit which C++ features you use (to the point where you are pretty much left with C) a lot of people won’t be able to use your library. PS. If your original comment had been phrased the way you put it here I might have made the same comment, but I would not have downvoted it. Here, you’re at least providing some supporting evidence for your assertions which makes it a much more valuable contribution to the conversation.
    - Const-me 7y ago
starsinspace 7y ago
I agree that "straight C" is not the best choice anymore... but C++ isn't great either. It inherits most of C's weaknesses and for libraries, it makes it very difficult to use the code from languages other than C++. By making a library in C++ you are basically limiting it to being used only in C++ projects. (Yes, wrapper generators for C++-to-whatever exist, but my experience with using e.g. Qt from other languages has always been pretty terrible). Even in 2019, the C ABI is the one universally agreed-upon cross-language ABI for languages compiled to native code.
- pjmlp 7y ago
  In what concerns security, both should be nuked. However given that at least C++ does support ways to tame C, after all the whole purpose was for Bjarne never to repeat his Simula into BCPL rewrite experience ever again, it is up for security conscious to decide what legacy they want to leave, when the option is between both those languages. On the other hand maybe C should be used to write Skynet, so that we stand a chance.
huhtenberg 7y ago
Reading through your comments the only take-away appears to be that you just really don't like C for whatever reason. C is a perfectly fine language for tasks of all kinds. The fact that it expects programmers to take greater care when using it is not a reason enough to dismiss it as a general-purpose language. Not everyone needs (or wants) to ride a tricycle wearing knee pads and a helmet to get from A to B.
- pjmlp 7y ago
  Ah the old straight jacket argument against computer security, never gets old. The reason is very simple, the billions of wasted money fixing security exploits caused by industry's adoption of C. Morris worm is more than 30 years old, and the old ways can still be used to attack modern systems that people insist in writing using C. https://msrc-blog.microsoft.com/2019/06/14/prevent-the-impact-of-a-linux-worm-by-updating-exim-cve-2019-10149/ https://msrc-blog.microsoft.com/2019/06/14/prevent-the-impac... https://support.apple.com/en-us/HT210348 https://support.apple.com/en-us/HT210348 https://msrc-blog.microsoft.com/2019/07/16/a-proactive-approach-to-more-secure-code/ https://msrc-blog.microsoft.com/2019/07/16/a-proactive-appro... https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Work https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr... https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html https://security.googleblog.com/2019/08/adopting-arm-memory-...