5 ms·

I'm continually (positively) amazed at the commitment to backwards compatibility from the Linux kernel team and continually abhorred by the number of footguns i

by dtech 5y ago

I'm continually (positively) amazed at the commitment to backwards compatibility from the Linux kernel team and continually abhorred by the number of footguns in C/POSIX/Linux.

mschuster91 5y ago
At least for the old POSIX stuff this is sort of excusable... it operated under very much more relaxed assumptions, primarily that people could trust each other to a somewhat large degree. Obviously, the rise of mass-population Internet access and financial (or "lulz") incentives for hackers changed the game, and we're still paying for all the decisions to be backwards-compatible, even decades later.
- pjmlp 5y ago
  The Morris worm already shown what the future would look like in the early 80's.
- deleted 5y ago
  [deleted]
bch 5y ago
I think the spec has not meaningfully changed in this regard since C89, and there’s a case of collective false memories[0] happening here. From a copy[1] of C89 I see the relevant description as: * The value of argc shall be nonnegative. * argv[argc] shall be a null pointer. So the spec is coherent and explained plainly. Developers/application code just needs to be mindful of what/how it’s dereferencing. [0] https://www.discovermagazine.com/mind/collective-false-memories-whats-behind-the-mandela-effect https://www.discovermagazine.com/mind/collective-false-memor... [1] http://port70.net/~nsz/c/c89/c89-draft.html http://port70.net/~nsz/c/c89/c89-draft.html
- jandrese 5y ago
  0 is a nonnegative number.
  - bch 5y ago
    > 0 is a nonnegative number. Correct. So it needs to be accounted for.
- deleted 5y ago
  [deleted]
- tedunangst 5y ago
  There is some additional commentary in the rationale section of posix. https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html https://pubs.opengroup.org/onlinepubs/9699919799/functions/e...
  - bch 5y ago
    This is pretty interesting - some tension between what C guarantees and what Strictly Conforming POSIX requires. I’m not saying there’s no confusion in the real world (it’s obvious there is). Is Postel’s Law Be conservative in what you send; be liberal in what you accept. relevant here? I’m not sure. The interesting looking parts of @tedunangst linked document are: The argument argv is an array of character pointers to null-terminated strings. The application shall ensure that the last member of this array is a null pointer. These strings shall constitute the argument list available to the new process image. The value in argv[0] should point to a filename string that is associated with the process being started by one of the exec functions. […] Early proposals required that the value of argc passed to main() be "one or greater". This was driven by the same requirement in drafts of the ISO C standard. In fact, historical implementations have passed a value of zero when no arguments are supplied to the caller of the exec functions. This requirement was removed from the ISO C standard and subsequently removed from this volume of POSIX.1-2017 as well. The wording, in particular the use of the word should, requires a Strictly Conforming POSIX Application to pass at least one argument to the exec function, thus guaranteeing that argc be one or greater when invoked by such an application. In fact, this is good practice, since many existing applications reference argv[0] without first checking the value of argc. The requirement on a Strictly Conforming POSIX Application also states that the value passed as the first argument be a filename string associated with the process being started. Although some existing applications pass a pathname rather than a filename string in some circumstances, a filename string is more generally useful, since the common usage of argv[0] is in printing diagnostics. In some cases the filename passed is not the actual filename of the file; for example, many implementations of the login utility use a convention of prefixing a <hyphen-minus> ( '-' ) to the actual filename, which indicates to the command interpreter being invoked that it is a "login shell".
- johncolanduoni 5y ago
  Just because it’s in a spec, doesn’t mean it’s not a footgun. No “collective false memories” required.
  - inetknght 5y ago
    There's no footgun here except for apps which make false assumptions about argc and/or argv.
    - tremon 5y ago
      Indeed, that's the footgun.
      - inetknght 5y ago
        At that point using C is the footgun. It's always been the case that argc is not-negative which means it could be zero. It's always been the case that argv[argc] is null. People who assume otherwise are poor C developers.
        zucker42 5y ago
        Yes, C is full of footguns; that's one fact that has motivated the creation of alternate systems programming languages. I think your definition of footgun is different from mine and that of the commenters you're responding to (and how I've generally seen it used).
- dtech 5y ago
  False memories? What are you blabbering about. Just because it's in the spec doesn't mean it's not a footgun. If something is in the spec and it blows up in you face if you're not careful that's by definition a footgun.
- Taniwha 5y ago
  there's a subtle distinction here in that what exec does going in and coming out of the kernel, and what are presented to main() by the libc preamble (which is what the C standard is about) are different (though very very related) things
im3w1l 5y ago
I don't think the behavior is wrong per se. Rather the issue is that it was tribal knowledge that the way you got the name of your binary was through argv[0]. And that this misinformation spread unchecked.

by dtech 5y ago

I'm continually (positively) amazed at the commitment to backwards compatibility from the Linux kernel team and continually abhorred by the number of footguns in C/POSIX/Linux.

mschuster91 5y ago

At least for the old POSIX stuff this is sort of excusable... it operated under very much more relaxed assumptions, primarily that people could trust each other to a somewhat large degree. Obviously, the rise of mass-population Internet access and financial (or "lulz") incentives for hackers changed the game, and we're still paying for all the decisions to be backwards-compatible, even decades later.

pjmlp 5y ago
The Morris worm already shown what the future would look like in the early 80's.
deleted 5y ago
[deleted]

bch 5y ago

I think the spec has not meaningfully changed in this regard since C89, and there’s a case of collective false memories[0] happening here. From a copy[1] of C89 I see the relevant description as: * The value of argc shall be nonnegative. * argv[argc] shall be a null pointer. So the spec is coherent and explained plainly. Developers/application code just needs to be mindful of what/how it’s dereferencing. [0] https://www.discovermagazine.com/mind/collective-false-memories-whats-behind-the-mandela-effect https://www.discovermagazine.com/mind/collective-false-memor... [1] http://port70.net/~nsz/c/c89/c89-draft.html http://port70.net/~nsz/c/c89/c89-draft.html

jandrese 5y ago
0 is a nonnegative number.
- bch 5y ago
  > 0 is a nonnegative number. Correct. So it needs to be accounted for.
deleted 5y ago
[deleted]
tedunangst 5y ago
There is some additional commentary in the rationale section of posix. https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html https://pubs.opengroup.org/onlinepubs/9699919799/functions/e...
- bch 5y ago
  This is pretty interesting - some tension between what C guarantees and what Strictly Conforming POSIX requires. I’m not saying there’s no confusion in the real world (it’s obvious there is). Is Postel’s Law Be conservative in what you send; be liberal in what you accept. relevant here? I’m not sure. The interesting looking parts of @tedunangst linked document are: The argument argv is an array of character pointers to null-terminated strings. The application shall ensure that the last member of this array is a null pointer. These strings shall constitute the argument list available to the new process image. The value in argv[0] should point to a filename string that is associated with the process being started by one of the exec functions. […] Early proposals required that the value of argc passed to main() be "one or greater". This was driven by the same requirement in drafts of the ISO C standard. In fact, historical implementations have passed a value of zero when no arguments are supplied to the caller of the exec functions. This requirement was removed from the ISO C standard and subsequently removed from this volume of POSIX.1-2017 as well. The wording, in particular the use of the word should, requires a Strictly Conforming POSIX Application to pass at least one argument to the exec function, thus guaranteeing that argc be one or greater when invoked by such an application. In fact, this is good practice, since many existing applications reference argv[0] without first checking the value of argc. The requirement on a Strictly Conforming POSIX Application also states that the value passed as the first argument be a filename string associated with the process being started. Although some existing applications pass a pathname rather than a filename string in some circumstances, a filename string is more generally useful, since the common usage of argv[0] is in printing diagnostics. In some cases the filename passed is not the actual filename of the file; for example, many implementations of the login utility use a convention of prefixing a <hyphen-minus> ( '-' ) to the actual filename, which indicates to the command interpreter being invoked that it is a "login shell".
johncolanduoni 5y ago
Just because it’s in a spec, doesn’t mean it’s not a footgun. No “collective false memories” required.
- inetknght 5y ago
  There's no footgun here except for apps which make false assumptions about argc and/or argv.
  - tremon 5y ago
    Indeed, that's the footgun.
    - inetknght 5y ago
      At that point using C is the footgun. It's always been the case that argc is not-negative which means it could be zero. It's always been the case that argv[argc] is null. People who assume otherwise are poor C developers.
      - zucker42 5y ago
        Yes, C is full of footguns; that's one fact that has motivated the creation of alternate systems programming languages. I think your definition of footgun is different from mine and that of the commenters you're responding to (and how I've generally seen it used).
dtech 5y ago
False memories? What are you blabbering about. Just because it's in the spec doesn't mean it's not a footgun. If something is in the spec and it blows up in you face if you're not careful that's by definition a footgun.
Taniwha 5y ago
there's a subtle distinction here in that what exec does going in and coming out of the kernel, and what are presented to main() by the libc preamble (which is what the C standard is about) are different (though very very related) things

im3w1l 5y ago

I don't think the behavior is wrong per se. Rather the issue is that it was tribal knowledge that the way you got the name of your binary was through argv[0]. And that this misinformation spread unchecked.