4 ms·
Microsoft, sure--nobody has worked harder than they have to try to make C++ safer. And there are other big companies seriously investing in making C++ safer (e
by Jweb_Guru 6y ago
Microsoft, sure--nobody has worked harder than they have to try to make C++ safer. And there are other big companies seriously investing in making C++ safer (e.g. Facebook, bad as they are otherwise).
But I've also talked to many of the researchers actually working on these projects--they'll freely tell you how hard the task is and how impossible it is to really apply Rust's straightforward solutions to the massive existing legacy of C++ code. And let's be honest--if your tool requires people to rewrite everything anyway, they might as well choose Rust, so it's not acceptable for your tool to only work on modern stuff, or require annotations everywhere you use std::string_view, etc.
And I should be very clear that this is quite specific to C and C++. Ada, for example, has been able to adopt solutions from Rust with ease, and even add some interesting improvements, because the safe subset of their language was conservative and the borrow checker allows them to extend it. So I'm not saying other languages cannot copy Rust, it's very much specific to unsafe by design languages like C++.
They're trying to make their existing codebases safer, and I think that's great, but unless there's a massive breakthrough in the next few years these aren't going to be general purpose solutions and they are definitely not going to be close to sound. For example, pretty much everything I'm aware of for C++ that tries to do memory safety, punts on thread safety, because it's just virtually impossible with all the other stuff going on; many of them punt on recursive function calls, and a bunch don't even do anything but very basic interprocedural analysis, focusing all their energy on "local" intraprocedural bugs that are much easier to catch. The tools would just be too noisy to be useful otherwise.
As for Google... they resisted investing in static analysis tools for years and I don't take them seriously at all when they talk about this sort of thing.
- pjmlp 6y agoGoogle is at least serious on Android with all the mitigations that have been added, inclusive being able to write drivers in Java (as per Project Treble), and it is thanks to them that Linux no longer uses VLAs. But for example, in spite of using Rust on ChromeOS, Fuchsia and now thinking of introducing Rust on Android 12+, there are no plans to expose it in any of the OS SDKs for userspace applications.
- Jweb_Guru 6y agoI didn't say Google didn't care about security, just that they have shown almost no interest in static analysis, and have shown a clear preference for runtime mechanisms like sandboxing and garbage collection for memory safety. That's why I find it weird that you're bringing them up here as some sort of leader in C++ static analysis, they very much aren't and have been quite dismissive of related work like verification as well. I'm also not sure what you mean by "exposing Rust in the userland SDK." Rust doesn't have a stable ABI, how would that even work? It's not like they're exposing system calls as C++ classes or anything like that, either. The choice of programming language for an operating system is, at least from the perspective of API design, mostly an implementation detail.