4 ms·

I wonder if Rust can be stripped down (or C can be enhanced) to basically be C with a borrow checker and other safety features? I can live without Cargo or evan

I wonder if Rust can be stripped down (or C can be enhanced) to basically be C with a borrow checker and other safety features? I can live without Cargo or evangelism, but I'd also like to live without CVEs.

ddevault 6y ago
That would be cool.
c-cube 6y ago
There's checked C [1] as the most recent take on a safer C. [1] https://www.microsoft.com/en-us/research/project/checked-c/ https://www.microsoft.com/en-us/research/project/checked-c/
thesuperbigfrog 6y ago
MISRA C (https://en.wikipedia.org/wiki/MISRA_C https://en.wikipedia.org/wiki/MISRA_C) is a stripped-down version of C that is used in critical applications.
- als0 6y ago
  MISRA C doesn't include a borrow checker, so it won't stop many memory safety issues. It's just a set of guidelines to discourage you from writing nasty or ambiguous C.
  - thesuperbigfrog 6y ago
    Yes. MISRA C might be a good candidate to add a borrow checker. I am not terribly familiar with the MISRA C rules, so I am not sure how much borrowing / move semantics is permitted under MISRA C.
pornel 6y ago
There are languages like that: https://www.microsoft.com/en-us/research/project/checked-c/ https://www.microsoft.com/en-us/research/project/checked-c/ They are doomed to fail. You get all the downsides of not-C with all the downsides of C. You still pay the cost of losing compatibility with standard compilers, and people with IBM/360 are still mad at you. You still pay the cost of learning borrow-checker-like semantics, and have to convince others to learn your unpopular language. But you get very little in return. It's still C with its old warts. Whenever safety is the only thing you gain, there's a ton of people like Drew who will tell you it's stupid, because "C can be safe", we've been trying for only 40 years, so it's too soon to give up. Rust attracts people who need safety, but they stay for the sum types, error handling, hygienic macros, and rich ecosystem.
jrtc27 6y ago
CHERI (http://cheri-cpu.org http://cheri-cpu.org) provides a spatially-safe C and C++, and also heap temporal safety (specifically it prevents use-after-reallocation, which is the actual vulnerability, since use-after-free doesn't matter if freed memory is never reallocated). Most code requires few, if any, changes (0.17% LoC in our fork of FreeBSD, which includes the kernel itself and all the low-level runtime libraries), with the changes tending to be due to people conflating pointers and integers (i.e. use uintptr_t not unsigned long/uint64_t for storing a union of a pointer and an integer, or a real union, and use size_t not uintptr_t when you mean a plain integer, though the latter can sometimes still work, just a little less efficiently and likely with some compiler warnings). It doesn't solve the concurrency issues, but unlike CHERI C/C++ those require invasive changes to the language and thus code. We have a technical report that gives an overview of CHERI and describes how to write good C/C++ that doesn't use dodgy idioms that break in CHERI C/C++ if you're interested at https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-947.html https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-947.html. Arm are also working on a prototype of Armv8-A with CHERI, dubbed Morello: https://www.morello-project.org https://www.morello-project.org.

ddevault 6y ago

That would be cool.

c-cube 6y ago

There's checked C [1] as the most recent take on a safer C. [1] https://www.microsoft.com/en-us/research/project/checked-c/ https://www.microsoft.com/en-us/research/project/checked-c/

thesuperbigfrog 6y ago

MISRA C (https://en.wikipedia.org/wiki/MISRA_C https://en.wikipedia.org/wiki/MISRA_C) is a stripped-down version of C that is used in critical applications.

als0 6y ago
MISRA C doesn't include a borrow checker, so it won't stop many memory safety issues. It's just a set of guidelines to discourage you from writing nasty or ambiguous C.
- thesuperbigfrog 6y ago
  Yes. MISRA C might be a good candidate to add a borrow checker. I am not terribly familiar with the MISRA C rules, so I am not sure how much borrowing / move semantics is permitted under MISRA C.

pornel 6y ago

There are languages like that: https://www.microsoft.com/en-us/research/project/checked-c/ https://www.microsoft.com/en-us/research/project/checked-c/ They are doomed to fail. You get all the downsides of not-C with all the downsides of C. You still pay the cost of losing compatibility with standard compilers, and people with IBM/360 are still mad at you. You still pay the cost of learning borrow-checker-like semantics, and have to convince others to learn your unpopular language. But you get very little in return. It's still C with its old warts. Whenever safety is the only thing you gain, there's a ton of people like Drew who will tell you it's stupid, because "C can be safe", we've been trying for only 40 years, so it's too soon to give up. Rust attracts people who need safety, but they stay for the sum types, error handling, hygienic macros, and rich ecosystem.

jrtc27 6y ago

CHERI (http://cheri-cpu.org http://cheri-cpu.org) provides a spatially-safe C and C++, and also heap temporal safety (specifically it prevents use-after-reallocation, which is the actual vulnerability, since use-after-free doesn't matter if freed memory is never reallocated). Most code requires few, if any, changes (0.17% LoC in our fork of FreeBSD, which includes the kernel itself and all the low-level runtime libraries), with the changes tending to be due to people conflating pointers and integers (i.e. use uintptr_t not unsigned long/uint64_t for storing a union of a pointer and an integer, or a real union, and use size_t not uintptr_t when you mean a plain integer, though the latter can sometimes still work, just a little less efficiently and likely with some compiler warnings). It doesn't solve the concurrency issues, but unlike CHERI C/C++ those require invasive changes to the language and thus code. We have a technical report that gives an overview of CHERI and describes how to write good C/C++ that doesn't use dodgy idioms that break in CHERI C/C++ if you're interested at https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-947.html https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-947.html. Arm are also working on a prototype of Armv8-A with CHERI, dubbed Morello: https://www.morello-project.org https://www.morello-project.org.