5 ms·

Zig has very little focus on safety and has had several regressions related to security and correctness, most of which Andrew has said he doesn't care about as

by junon 6y ago

Zig has very little focus on safety and has had several regressions related to security and correctness, most of which Andrew has said he doesn't care about as much. This concerns me greatly. The discord community operates like a cult (sound familiar, Rust community?) and any criticisms or anything not exuberantly positive results in a flame war. I saw all of that happen several times so far with the community and it's ultimately what drove me away from the project altogether.

gameswithgo 6y ago
Every language has overzealous fans, when a language is new this is likely a largely percentage of the community. If you use that as a reason to avoid a language you will likely just end up avoiding new languages.
- junon 6y ago
  See my other comment. It's more the fact Andrew stepped into the conversation himself and just said "be nice" instead of addressing security concerns, just fueling the flame war even more. A response to a security concern should never be "fuck off".
  - deleted 6y ago
    [deleted]
  - geodel 6y ago
    > A response to a security concern should never be "fuck off". It can be when it is out of context and/or out of proportion. But it could be more likely that temperamentally you are disposed towards different programing language where security concerns must override any and every issue at hand.
drcode 6y ago
Any new language project in 2020, for good or ill, is going to be highly opinionated and self-select for people who share similar views on language design. When someone comes along on their discord and says "you need to have this security and correctness issue that I care about deeply fixed yesterday" you really can't be surprised if not everyone shares your urgency- There are probably other languages/communities that DO care deeply about exactly those types of issues, that's the beauty of the long tail of the internet.
- dna_polymerase 6y ago
  Yes, a bit of tribalism seems to be ingrained in every online community these days. That clashes with a lot of people having pretty high expectations for code provided for free to them.
  - junon 6y ago
    I don't see how those two things coincide at all. Further, your second statement is a strawman - for a project and community that touts being a serious replacement for C, there are indeed expectations about the security mindset of the individual providing the code. When the project has 7k+ stars on Github, clearly people are looking at it and using it. If the maintainer is being unsafe, it's ridiculous to imply nobody is allowed to be critical of that.
CyberRabbi 6y ago
No offense intended at all but I had a similar experience with the zig community.
- vips7L 6y ago
  I had the opposite experience. They were welcoming and helped me solve some very off the beaten path issues.
  - junon 6y ago
    They're fine if you don't bring up criticisms. God help your soul if you do.
    - AnIdiotOnTheNet 6y ago
      I've argued with Andrew about Zig features and I never felt it was hostile in any way. In fact, I found him remarkably patient. I was always on the IRC though. It could be the discord community is less mature.
asddubs 6y ago
>Zig has very little focus on safety and has had several regressions related to security and correctness, most of which Andrew has said he doesn't care about as much. can you be a bit more specific?
- junon 6y ago
  A regression appeared where members were accessible outside of their scopes even without the `pub` modifier. This took months to fix and the person bringing it up initially was yelled at about not understanding programming languages in the discord channel. Another one I personally brought up was that the standard library's utf-8 module had a decoder that panics on invalid input sequences, certainly setting consumers up for DOS attacks with malformed utf-8 inputs. EDIT: DOS vulnerability is still there (https://github.com/ziglang/zig/blob/master/lib/std/unicode.zig#L695-L697 https://github.com/ziglang/zig/blob/master/lib/std/unicode.z..., PR to fix that was closed https://github.com/ziglang/zig/pull/4929 https://github.com/ziglang/zig/pull/4929). I never responded to the PR because it was at that moment I decided to abandon Zig altogether. The response to the latter was pretty much "the standard library isn't meant to be used right now", to which I really don't have a response. There was a very, very long and heated argument in the discord channel about it where instead of addressing the concerns about DOS and security I was instead insulted for apparently trying to taint an otherwise perfect language. The community is vile and the few examples I've seen of the maintainer disregarding safety and security in this way don't give me any amount of confidence in the project overall. EDIT: Worth mentioning, the syntax and semantics surrounding Zig are not new ideas. I'm sure another project will pop up at some point to compete; many discussions I've seen in the language design channels on IRC and a few discord servers have many people arriving at similar conclusions Zig has made, without knowing Zig even exists. I think we're slowly converging on a language that looks a lot like Zig, but I don't think Zig will be its ultimate incarnation.
  - dnautics 6y ago
    Looking at that unicode PR, It seems like the thought process is "we don't want to spend time fixing unicode security regressions until we have stabilized the rest of the language", the unicode library is totally broken rn, don't fix a minor part of the problem.
AndyKelley 6y ago
> security and correctness, most of which Andrew has said he doesn't care about as much You will find me to be quite open minded about criticism but you're not going to get very far by misquoting me. I have an entire kanban board[1] dedicated to improving safety, and "security and correctness" are both properties of the word "robust" which is the very first adjective ziglang.org uses to describe the language. I could spend 20 more minutes on HN debunking the claims in this thread, but instead of rewarding your behavior I'm going to give that time instead to the people who have opened pull requests on Zig and help them get their code merged. [1]: https://github.com/ziglang/zig/projects/3 https://github.com/ziglang/zig/projects/3
kristoff_it 6y ago
Junon, you are mistakenly assuming that a language that aims to be safe has to prioritize safety all the way from inception to maturity. Right now Zig has much, much, bigger priorities than safety. The language is not yet production-ready for almost every production use-case, and that should not be a surprise to anybody that has looked into it a bit. We even had somebody make a "Using Zig in Production" talk that started with a few jokes on how he decided to do so despite Andrew publicly saying that it's too early. Right now docs, tooling, the self-hosted compiler, making design decisions on corners of the language not yet finalized, getting more contributors, getting funding to speed up development (and give back to contributors), and building up the community are all needs with an immensely higher level of priority. On the last point, the community, since that's my job, I'll spare a couple more words: "the" discord community doesn't exist. The Zig community is decentralized and anyone is free to start their own space, as stated in the Community wiki page of the project https://github.com/ziglang/zig/wiki/Community https://github.com/ziglang/zig/wiki/Community So when it comes to Discord servers, at the moment of writing there are two listed in that document: the older, bigger one, and mine. You are probably talking about the bigger one, where I can see your discussions with other members. From what I can see in the logs, the discussions were calm and reasonable. I also don't see any of the insults that you refer to in your other comments. In case I missed them though, you'd need to raise the problem with the moderators of that space, and not chalk it up to 'the community' being a cult. This is very different compared to how Rust runs its communities btw. I'm sorry, but from what I can gather in your case you simply had strong opinions on specific topics and other people just disagreed with you, partially for design (i.e. non strictly technical) reasons. From what I can see from your other comments in this thread, my only recommendation is to work on being more dispassionate when approaching a new community and when issuing PRs (btw a good way of avoiding doing useless work is to open an issue first or to find Andrew / other core contributors on IRC and get their opinion). At the end of the day Zig is an opinionated project where Andrew gives the final approval on what the language should or should not be. By missing that nuance, you built up expectations that in the end were unmet, resulting in understandable frustration. That said, from my PoV, this doesn't justify excessive criticism of Zig and its community. As for debating changes and raising criticism, we do that too, but to do that successfully you need to understand more the nuances in the history and design of Zig. https://github.com/ziglang/zig/issues/6600 https://github.com/ziglang/zig/issues/6600 https://www.youtube.com/watch?v=880uR25pP5U https://www.youtube.com/watch?v=880uR25pP5U

by junon 6y ago

gameswithgo 6y ago

Every language has overzealous fans, when a language is new this is likely a largely percentage of the community. If you use that as a reason to avoid a language you will likely just end up avoiding new languages.

junon 6y ago
See my other comment. It's more the fact Andrew stepped into the conversation himself and just said "be nice" instead of addressing security concerns, just fueling the flame war even more. A response to a security concern should never be "fuck off".
- deleted 6y ago
  [deleted]
- geodel 6y ago
  > A response to a security concern should never be "fuck off". It can be when it is out of context and/or out of proportion. But it could be more likely that temperamentally you are disposed towards different programing language where security concerns must override any and every issue at hand.

drcode 6y ago

Any new language project in 2020, for good or ill, is going to be highly opinionated and self-select for people who share similar views on language design. When someone comes along on their discord and says "you need to have this security and correctness issue that I care about deeply fixed yesterday" you really can't be surprised if not everyone shares your urgency- There are probably other languages/communities that DO care deeply about exactly those types of issues, that's the beauty of the long tail of the internet.

dna_polymerase 6y ago
Yes, a bit of tribalism seems to be ingrained in every online community these days. That clashes with a lot of people having pretty high expectations for code provided for free to them.
- junon 6y ago
  I don't see how those two things coincide at all. Further, your second statement is a strawman - for a project and community that touts being a serious replacement for C, there are indeed expectations about the security mindset of the individual providing the code. When the project has 7k+ stars on Github, clearly people are looking at it and using it. If the maintainer is being unsafe, it's ridiculous to imply nobody is allowed to be critical of that.

CyberRabbi 6y ago

No offense intended at all but I had a similar experience with the zig community.

vips7L 6y ago
I had the opposite experience. They were welcoming and helped me solve some very off the beaten path issues.
- junon 6y ago
  They're fine if you don't bring up criticisms. God help your soul if you do.
  - AnIdiotOnTheNet 6y ago
    I've argued with Andrew about Zig features and I never felt it was hostile in any way. In fact, I found him remarkably patient. I was always on the IRC though. It could be the discord community is less mature.

asddubs 6y ago

>Zig has very little focus on safety and has had several regressions related to security and correctness, most of which Andrew has said he doesn't care about as much. can you be a bit more specific?

junon 6y ago
A regression appeared where members were accessible outside of their scopes even without the `pub` modifier. This took months to fix and the person bringing it up initially was yelled at about not understanding programming languages in the discord channel. Another one I personally brought up was that the standard library's utf-8 module had a decoder that panics on invalid input sequences, certainly setting consumers up for DOS attacks with malformed utf-8 inputs. EDIT: DOS vulnerability is still there (https://github.com/ziglang/zig/blob/master/lib/std/unicode.zig#L695-L697 https://github.com/ziglang/zig/blob/master/lib/std/unicode.z..., PR to fix that was closed https://github.com/ziglang/zig/pull/4929 https://github.com/ziglang/zig/pull/4929). I never responded to the PR because it was at that moment I decided to abandon Zig altogether. The response to the latter was pretty much "the standard library isn't meant to be used right now", to which I really don't have a response. There was a very, very long and heated argument in the discord channel about it where instead of addressing the concerns about DOS and security I was instead insulted for apparently trying to taint an otherwise perfect language. The community is vile and the few examples I've seen of the maintainer disregarding safety and security in this way don't give me any amount of confidence in the project overall. EDIT: Worth mentioning, the syntax and semantics surrounding Zig are not new ideas. I'm sure another project will pop up at some point to compete; many discussions I've seen in the language design channels on IRC and a few discord servers have many people arriving at similar conclusions Zig has made, without knowing Zig even exists. I think we're slowly converging on a language that looks a lot like Zig, but I don't think Zig will be its ultimate incarnation.
- dnautics 6y ago
  Looking at that unicode PR, It seems like the thought process is "we don't want to spend time fixing unicode security regressions until we have stabilized the rest of the language", the unicode library is totally broken rn, don't fix a minor part of the problem.

AndyKelley 6y ago

> security and correctness, most of which Andrew has said he doesn't care about as much You will find me to be quite open minded about criticism but you're not going to get very far by misquoting me. I have an entire kanban board[1] dedicated to improving safety, and "security and correctness" are both properties of the word "robust" which is the very first adjective ziglang.org uses to describe the language. I could spend 20 more minutes on HN debunking the claims in this thread, but instead of rewarding your behavior I'm going to give that time instead to the people who have opened pull requests on Zig and help them get their code merged. [1]: https://github.com/ziglang/zig/projects/3 https://github.com/ziglang/zig/projects/3

kristoff_it 6y ago

Junon, you are mistakenly assuming that a language that aims to be safe has to prioritize safety all the way from inception to maturity. Right now Zig has much, much, bigger priorities than safety. The language is not yet production-ready for almost every production use-case, and that should not be a surprise to anybody that has looked into it a bit. We even had somebody make a "Using Zig in Production" talk that started with a few jokes on how he decided to do so despite Andrew publicly saying that it's too early. Right now docs, tooling, the self-hosted compiler, making design decisions on corners of the language not yet finalized, getting more contributors, getting funding to speed up development (and give back to contributors), and building up the community are all needs with an immensely higher level of priority. On the last point, the community, since that's my job, I'll spare a couple more words: "the" discord community doesn't exist. The Zig community is decentralized and anyone is free to start their own space, as stated in the Community wiki page of the project https://github.com/ziglang/zig/wiki/Community https://github.com/ziglang/zig/wiki/Community So when it comes to Discord servers, at the moment of writing there are two listed in that document: the older, bigger one, and mine. You are probably talking about the bigger one, where I can see your discussions with other members. From what I can see in the logs, the discussions were calm and reasonable. I also don't see any of the insults that you refer to in your other comments. In case I missed them though, you'd need to raise the problem with the moderators of that space, and not chalk it up to 'the community' being a cult. This is very different compared to how Rust runs its communities btw. I'm sorry, but from what I can gather in your case you simply had strong opinions on specific topics and other people just disagreed with you, partially for design (i.e. non strictly technical) reasons. From what I can see from your other comments in this thread, my only recommendation is to work on being more dispassionate when approaching a new community and when issuing PRs (btw a good way of avoiding doing useless work is to open an issue first or to find Andrew / other core contributors on IRC and get their opinion). At the end of the day Zig is an opinionated project where Andrew gives the final approval on what the language should or should not be. By missing that nuance, you built up expectations that in the end were unmet, resulting in understandable frustration. That said, from my PoV, this doesn't justify excessive criticism of Zig and its community. As for debating changes and raising criticism, we do that too, but to do that successfully you need to understand more the nuances in the history and design of Zig. https://github.com/ziglang/zig/issues/6600 https://github.com/ziglang/zig/issues/6600 https://www.youtube.com/watch?v=880uR25pP5U https://www.youtube.com/watch?v=880uR25pP5U