4 ms·

That paper has many problems. For example: > There is no particular need to rewrite existing C code, provided the same benefit can be obtained more cheaply by

by roca 5y ago

That paper has many problems. For example: > There is no particular need to rewrite existing C code, provided the same benefit can be obtained more cheaply by alternative implementations of C To be clear, those "alternative implementations" do not exist, and no-one actually working on C compilers or tools to make C code safer has been able to produce one, or even come up with a credible plan for producing one.

h_anna_h 5y ago
This is false. There are multiple safe C implementations. compcert and https://staff.aist.go.jp/y.oiwa/FailSafeC/index-en.html https://staff.aist.go.jp/y.oiwa/FailSafeC/index-en.html are two such.
- roca 5y ago
  Compcert is a verified compiler. It guarantees that the generated code does what the source code requires. It doesn't turn unsafe C programs into safe ones. "Fail-Safe C" is a research project that has been dead for ten years. Note: > Some benchmark results show that the execution time are around 3 to 5 times of the original, natively-compiled programs, in avarage That overhead is actually a lot higher than similar projects I also consider failures, such as CCured. To be clear, when we talk about "an alternative implementation of C", it needs to give similar performance and other properties (e.g. function and data interop) to other C compilers. You can't impose a 3-5x slowdown and say "look, C is safe".
  - pjmlp 5y ago
    Actually that is what Oracle did with SPARC ADI, Google/ARM are pushing for with MTE, Apple is trying to do with PAC, Microsoft with Phonon. When everything else fails, kill the bug with hardware memory tagging spray.
  - h_anna_h 5y ago
    The CompCert C reference interpreter aborts execution on undefined behavior. > To be clear, when we talk about "an alternative implementation of C", it needs to give similar performance and other properties (e.g. function and data interop) to other C compilers. You can't impose a 3-5x slowdown and say "look, C is safe". Pretty much every language (except rust) which claims to be "C but safe" has the same issue, except you have to rewrite your program in it.
    - the_why_of_y 5y ago
      > The CompCert C reference interpreter aborts execution on undefined behavior. A C interpreter is not exactly the sort of thing that the embedded software industry has been waiting to deploy in production.
trasz 5y ago
Of course they exist, see eg CHERI: https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/
- roca 5y ago
  CHERI is far more than just an "alternative implementation of C". It includes a completely different hardware platform and replacing all your hardware can hardly be considered "cheap".
  - trasz 5y ago
    It's many orders of magnitude cheaper than replacing all your software.
    - staticassertion 5y ago
      You can't just adopt that hardware and get memory safety. The hardware is providing support for a capabilities model, which you then have to adopt at a software level both within your OS, compiler, and application code. This also would break C and C++ ABIs, so it's very unlikely to get adopted for a number of cases. Further, CHERI is not enough to achieve temporal memory safety, it only provides the primitive that one could use to implement an efficient, correct tracing GC. Perhaps most importantly, one can not use CHERI today. It is just not an option. Memory safe languages exist, and have existed for quite some time. Pointer tagging and other approaches like CHERI are very promising. Keeping in mind of course that they double the size of pointers and have a global runtime performance cost. Less ambitious but otherwise similar mitigations are already being adopted.
      - trasz 5y ago
        Indeed, you need the whole stack. However, the (non-temporal) memory safety alone is still quite easy to get - the compiler will take care of it, as a programmer you just need to make sure your code doesn't get in the way by eg manually stashing pointers into non-pointer types. It's been demonstrated on large, real-world code bases, such as FreeBSD and PostgreSQL. (Disclaimer: been there, done that, part of the CHERI team)
neolog 5y ago
The author of that paper has written a safe C implementation. https://github.com/stephenrkell/libcrunch https://github.com/stephenrkell/libcrunch
- roca 5y ago
  I applaud him for giving it a go, but it's far from complete ... no use-after-free protection at all yet, for example.

by roca 5y ago

h_anna_h 5y ago

This is false. There are multiple safe C implementations. compcert and https://staff.aist.go.jp/y.oiwa/FailSafeC/index-en.html https://staff.aist.go.jp/y.oiwa/FailSafeC/index-en.html are two such.

roca 5y ago
Compcert is a verified compiler. It guarantees that the generated code does what the source code requires. It doesn't turn unsafe C programs into safe ones. "Fail-Safe C" is a research project that has been dead for ten years. Note: > Some benchmark results show that the execution time are around 3 to 5 times of the original, natively-compiled programs, in avarage That overhead is actually a lot higher than similar projects I also consider failures, such as CCured. To be clear, when we talk about "an alternative implementation of C", it needs to give similar performance and other properties (e.g. function and data interop) to other C compilers. You can't impose a 3-5x slowdown and say "look, C is safe".
- pjmlp 5y ago
  Actually that is what Oracle did with SPARC ADI, Google/ARM are pushing for with MTE, Apple is trying to do with PAC, Microsoft with Phonon. When everything else fails, kill the bug with hardware memory tagging spray.
- h_anna_h 5y ago
  The CompCert C reference interpreter aborts execution on undefined behavior. > To be clear, when we talk about "an alternative implementation of C", it needs to give similar performance and other properties (e.g. function and data interop) to other C compilers. You can't impose a 3-5x slowdown and say "look, C is safe". Pretty much every language (except rust) which claims to be "C but safe" has the same issue, except you have to rewrite your program in it.
  - the_why_of_y 5y ago
    > The CompCert C reference interpreter aborts execution on undefined behavior. A C interpreter is not exactly the sort of thing that the embedded software industry has been waiting to deploy in production.

trasz 5y ago

Of course they exist, see eg CHERI: https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/

roca 5y ago
CHERI is far more than just an "alternative implementation of C". It includes a completely different hardware platform and replacing all your hardware can hardly be considered "cheap".
- trasz 5y ago
  It's many orders of magnitude cheaper than replacing all your software.
  - staticassertion 5y ago
    You can't just adopt that hardware and get memory safety. The hardware is providing support for a capabilities model, which you then have to adopt at a software level both within your OS, compiler, and application code. This also would break C and C++ ABIs, so it's very unlikely to get adopted for a number of cases. Further, CHERI is not enough to achieve temporal memory safety, it only provides the primitive that one could use to implement an efficient, correct tracing GC. Perhaps most importantly, one can not use CHERI today. It is just not an option. Memory safe languages exist, and have existed for quite some time. Pointer tagging and other approaches like CHERI are very promising. Keeping in mind of course that they double the size of pointers and have a global runtime performance cost. Less ambitious but otherwise similar mitigations are already being adopted.
    - trasz 5y ago
      Indeed, you need the whole stack. However, the (non-temporal) memory safety alone is still quite easy to get - the compiler will take care of it, as a programmer you just need to make sure your code doesn't get in the way by eg manually stashing pointers into non-pointer types. It's been demonstrated on large, real-world code bases, such as FreeBSD and PostgreSQL. (Disclaimer: been there, done that, part of the CHERI team)

neolog 5y ago

The author of that paper has written a safe C implementation. https://github.com/stephenrkell/libcrunch https://github.com/stephenrkell/libcrunch

roca 5y ago
I applaud him for giving it a go, but it's far from complete ... no use-after-free protection at all yet, for example.