3 ms·
"The Unix-style process model has virtues that the OP doesn't seem to grok. It's sometimes helpful to be able to restart one server from a completely clean memo
by sedachv 16y ago
"The Unix-style process model has virtues that the OP doesn't seem to grok. It's sometimes helpful to be able to restart one server from a completely clean memory image without taking the rest of the system down."
Unix processes virtualize real processes by providing indirection to the basic state identifiers of machine code - memory addresses. It's actually much simpler to virtualize a Lisp image - the basic identifiers are symbols. Dynamic binding already lets you do this to parts of the Lisp process. What's needed is an extension to let you do this for packages/modules.
"That is --- "omit safety checks, just trust me that my array accesses are all in bounds and I'm getting the types right." Code compiled this way is not inherently safer than C, and has to be coded up with equal care.
So, at the very least, the "quite safe" guarantee applies only to code compiled with full safety checks, which typically come with a very large performance hit."
With the Common Lisp model of optimization you can do this selectively for parts of your code, and the compiler can ignore your type hints or declarations if it wants to.
Array bounds checking can be lifted out of loops because CL arrays come with information about their dimensions. This is a fundamental and unfixable problem in C.
Type safety checks are only a performance problem in numeric loops, where it's always possible to provide the compiler with type information so that it can produce provably correct code (if you're looping over arrays of floats, you only have to check the type of the array once outside of the loop - again, this is a fundamental problem of C that is unfixable).
People have wasted hundreds of man-years trying to come up with automatic verifiers and safe subsets of C, but the language has so many problems and so few upsides that none of that work is worth it if you want to build reliable systems. Everything about C that is broken is actually very easy to fix, as long as you don't mind not using C.
- astrange 16y ago> With the Common Lisp model of optimization you can do this selectively for parts of your code, and the compiler can ignore your type hints or declarations if it wants to. What if those parts of your code have bugs in them? There's no reason they wouldn't, and whoever's writing file format parsers (fonts, video, JPEG) on your platform is going to turn off safety because it's too slow, even though that code has many attack surfaces.
- sedachv 16y agoYou're making a lot of assumptions: 1. Those type checks will be too slow 2. The compiler will choose to follow declarations for untrusted code 3. The declarations will lead to bugs on some inputs 4. Those bugs will be exploitable 5. Somehow those exploits will be worse than what's currently the case with C 99% of C exploits are string/buffer overflows. Bounds checking is not expensive, especially when your arrays carry around their size information. You can enable it in many current C compilers. W^X is an attempt to put something resembling bounds checking into the hardware. I honestly don't understand the people that argue bounds checking is too slow. How many times do you have to make the same mistake to realize that what you're doing is wrong? It's just idiotic.