4 ms·

C is easy to learn, but very hard to master. Having self learned C devs do a big, complex program is an invitation for security vulnerabilities. Most of the t

C is easy to learn, but very hard to master. Having self learned C devs do a big, complex program is an invitation for security vulnerabilities. Most of the time people find themselves fighting against the language, and struggling to have the program simply not to crash. If you see that, you start to think how much those guys would have time left to ensure anything like input sanitation, or code hardening in general.

j-james 6y ago
For someone planning on learning C in the next couple of months (through K&R), do you have any advice on where to learn best modern practices afterwards?
- baybal2 6y ago
  Unfortunately not, and I see it as a big downside of C where you can only learn about important corner cases with your own bitter experience, direct instruction. Advanced C usage remaining a black magic is not strength, it's weakness. This assures that attackers will always have a significantly stronger upper hand against industry's salaryman developers.
  - junon 6y ago
    "Advanced C usage" can you explain this, please? What in C is so "advanced" that it's more black magic than C++ or Rust or any other high level language? With C, what you see is what you get. I don't see how that can possibly be black magic.
    - baybal2 6y ago
      The problem is that you don't see that much. Compiler these days optimise the code beyond human comprehension. Memory management libs, and what hardware does with your physical memory layout is inscrutable. Register level vulnerabilities are very much black magic for anybody, but silicon maker itself. Memory management libs used by any big C program add to complexity. Fancy runtime pointer, and ROP sanitation libs fix some types of vulnerabilities, and add another. And so, and so, and so. I am a big proponent of C, but will not hide that C needs substantial education beyond just programming to use properly, and safely.
- rseacord 6y ago
  I like Effective C: An Introduction to Professional C Programming https://nostarch.com/Effective_C https://nostarch.com/Effective_C but I would since I wrote it.
  - blindluke 6y ago
    I like it too, very much so, to the point where I recommend it to people that find K. N. King's "C Programming: A Lengthy Approach" too intimidating. And I had nothing to do with writing it, as you obviously know. My sincere thanks for the book.
scoutt 6y ago
Nowadays it's more like: >Most of the time people find themselves fighting against the language, and struggling to have the program simply to ... compile.

j-james 6y ago

For someone planning on learning C in the next couple of months (through K&R), do you have any advice on where to learn best modern practices afterwards?

baybal2 6y ago
Unfortunately not, and I see it as a big downside of C where you can only learn about important corner cases with your own bitter experience, direct instruction. Advanced C usage remaining a black magic is not strength, it's weakness. This assures that attackers will always have a significantly stronger upper hand against industry's salaryman developers.
- junon 6y ago
  "Advanced C usage" can you explain this, please? What in C is so "advanced" that it's more black magic than C++ or Rust or any other high level language? With C, what you see is what you get. I don't see how that can possibly be black magic.
  - baybal2 6y ago
    The problem is that you don't see that much. Compiler these days optimise the code beyond human comprehension. Memory management libs, and what hardware does with your physical memory layout is inscrutable. Register level vulnerabilities are very much black magic for anybody, but silicon maker itself. Memory management libs used by any big C program add to complexity. Fancy runtime pointer, and ROP sanitation libs fix some types of vulnerabilities, and add another. And so, and so, and so. I am a big proponent of C, but will not hide that C needs substantial education beyond just programming to use properly, and safely.
rseacord 6y ago
I like Effective C: An Introduction to Professional C Programming https://nostarch.com/Effective_C https://nostarch.com/Effective_C but I would since I wrote it.
- blindluke 6y ago
  I like it too, very much so, to the point where I recommend it to people that find K. N. King's "C Programming: A Lengthy Approach" too intimidating. And I had nothing to do with writing it, as you obviously know. My sincere thanks for the book.

scoutt 6y ago

Nowadays it's more like: >Most of the time people find themselves fighting against the language, and struggling to have the program simply to ... compile.