4 ms·

It is super annoying that it isn't done more. I'd love to be able to opt in to bounds checking when I feel it is needed. I have no bloody idea why language de

It is super annoying that it isn't done more. I'd love to be able to opt in to bounds checking when I feel it is needed. I have no bloody idea why language designers seem so intent on not letting me choose what perf/safety trade-off is worthwhile for me. :/

pjmlp 6y ago
Easy, use C++. While not perfect, given its copy-paste compatibility with C, you can opt-in into bounds checking by using the STL data types, or similar. Then you can also make use of compiler switches, to opt-in in changing the behaviour of operator[]() to do bounds checking. With templates, you can opt-in into checked numerics. While not perfect, and maybe it will be replaced by Rust or other candidate someday, it already offered plenty of opt-in possiblities since early 90's, no need to keep writing C.
- com2kid 6y ago
  > While not perfect, given its copy-paste compatibility with C, you can opt-in into bounds checking by using the STL data types, or similar. I've heard of abuses of templates to add something that resembles proper ranged types, but it is not a path I'd want to go down. Partly, because C++ templates are not an excuse for a proper type system, even if they are a tool that can be used to force a type system into the language. A proper type system lets you do things like add centimeters and meters together, divide by seconds, and pop out a proper unit and ensure no overflow happens. A proper type system lets you easily, without the visual noise or compile time hit that templates have, add bounds checking wherever it is appropriate. type Age is Integer range 0 .. 130 type Day_Of_Week is (Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday); subtype Working_Day is Day_Of_Week range Monday .. Friday; Take a look at https://en.wikibooks.org/wiki/Ada_Programming/Type_System#Defining_new_types_and_subtypes https://en.wikibooks.org/wiki/Ada_Programming/Type_System#De... For all the flak it gets, Ada did this right long ago. And a huge part of all this is compile time only, and you can opt in/out of the runtime checks as performance dictates. I'd kill for a proper "milliseconds" type everywhere, one that can only have other milliseconds added to it. And then double the fun with a "seconds" type, and a language that keeps track of which is which for me. Why the heck am I writing timeInMs or timeInSeconds still? Subtyping integers should be a basic and primitive operation in any modern language.
  - pjmlp 6y ago
    I know most Wirth based languages relatively well. Actually your examples are even possible in Pascal. type Age = 0 .. 130; Day_Of_Week = (Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday); Working_Day = Monday .. Friday; However in 1992, C++ was a viable path forward on PC, whereas Ada was too expensive and Modula-2 compilers weren't getting the love they needed from OS vendors (https://freepages.modula2.org/compi.html https://freepages.modula2.org/compi.html), so C++ was the best alternative to move from Object Pascal into cross platform development. So while C++ isn't perfect, its copy-paste compatibility was key for its adoption, but also the reason why C++ will never be Ada in regards to security. Just like TypeScript or the JVM guest languages, have to deal with the semantics of the underlying platform. In any case, in what concerns opt-in, C++ provides the options, and using C already in 1992 was a matter of being religiously against C++. RAII, proper strings and arrays data structures with bounds checking and reference parameters instead of pointers were already available. From the 5 surviving Ada vendors, there is a free option, so anyone that cares about security with the issues that C brings into C++, can also have a look at it. In fact, GenodeOS, seL4 and NVidia Autonomous Vehicle project are all using Ada/SPARK to some extent, as they considered investing into Ada a better option than adopting Rust, given its history in production.
    - q-big 6y ago
      > In fact, GenodeOS, seL4 and NVidia Autonomous Vehicle project are all using Ada/SPARK to some extent, As far as I am aware, seL4 does not use Ada/SPARK, but C (with some assembler snippets), and Isabelle/HOL (for the proofs). This is also what is written in https://wwwnipkow.in.tum.de/teaching/proof21/SS18/files/14-final.pdf https://wwwnipkow.in.tum.de/teaching/proof21/SS18/files/14-f...
      - pjmlp 6y ago
        My mistake, I thought that Componolit work was for seL4, but it is also for Genode. https://componolit.com/index_en.html#components https://componolit.com/index_en.html#components
  - 6y ago

pjmlp 6y ago

Easy, use C++. While not perfect, given its copy-paste compatibility with C, you can opt-in into bounds checking by using the STL data types, or similar. Then you can also make use of compiler switches, to opt-in in changing the behaviour of operator[]() to do bounds checking. With templates, you can opt-in into checked numerics. While not perfect, and maybe it will be replaced by Rust or other candidate someday, it already offered plenty of opt-in possiblities since early 90's, no need to keep writing C.

com2kid 6y ago
> While not perfect, given its copy-paste compatibility with C, you can opt-in into bounds checking by using the STL data types, or similar. I've heard of abuses of templates to add something that resembles proper ranged types, but it is not a path I'd want to go down. Partly, because C++ templates are not an excuse for a proper type system, even if they are a tool that can be used to force a type system into the language. A proper type system lets you do things like add centimeters and meters together, divide by seconds, and pop out a proper unit and ensure no overflow happens. A proper type system lets you easily, without the visual noise or compile time hit that templates have, add bounds checking wherever it is appropriate. type Age is Integer range 0 .. 130 type Day_Of_Week is (Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday); subtype Working_Day is Day_Of_Week range Monday .. Friday; Take a look at https://en.wikibooks.org/wiki/Ada_Programming/Type_System#Defining_new_types_and_subtypes https://en.wikibooks.org/wiki/Ada_Programming/Type_System#De... For all the flak it gets, Ada did this right long ago. And a huge part of all this is compile time only, and you can opt in/out of the runtime checks as performance dictates. I'd kill for a proper "milliseconds" type everywhere, one that can only have other milliseconds added to it. And then double the fun with a "seconds" type, and a language that keeps track of which is which for me. Why the heck am I writing timeInMs or timeInSeconds still? Subtyping integers should be a basic and primitive operation in any modern language.
- pjmlp 6y ago
  I know most Wirth based languages relatively well. Actually your examples are even possible in Pascal. type Age = 0 .. 130; Day_Of_Week = (Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday); Working_Day = Monday .. Friday; However in 1992, C++ was a viable path forward on PC, whereas Ada was too expensive and Modula-2 compilers weren't getting the love they needed from OS vendors (https://freepages.modula2.org/compi.html https://freepages.modula2.org/compi.html), so C++ was the best alternative to move from Object Pascal into cross platform development. So while C++ isn't perfect, its copy-paste compatibility was key for its adoption, but also the reason why C++ will never be Ada in regards to security. Just like TypeScript or the JVM guest languages, have to deal with the semantics of the underlying platform. In any case, in what concerns opt-in, C++ provides the options, and using C already in 1992 was a matter of being religiously against C++. RAII, proper strings and arrays data structures with bounds checking and reference parameters instead of pointers were already available. From the 5 surviving Ada vendors, there is a free option, so anyone that cares about security with the issues that C brings into C++, can also have a look at it. In fact, GenodeOS, seL4 and NVidia Autonomous Vehicle project are all using Ada/SPARK to some extent, as they considered investing into Ada a better option than adopting Rust, given its history in production.
  - q-big 6y ago
    > In fact, GenodeOS, seL4 and NVidia Autonomous Vehicle project are all using Ada/SPARK to some extent, As far as I am aware, seL4 does not use Ada/SPARK, but C (with some assembler snippets), and Isabelle/HOL (for the proofs). This is also what is written in https://wwwnipkow.in.tum.de/teaching/proof21/SS18/files/14-final.pdf https://wwwnipkow.in.tum.de/teaching/proof21/SS18/files/14-f...
    - pjmlp 6y ago
      My mistake, I thought that Componolit work was for seL4, but it is also for Genode. https://componolit.com/index_en.html#components https://componolit.com/index_en.html#components
- 6y ago