3 ms·

> they are halfway to implementing a garbage collector already This is a common misunderstanding. The key insight of this work is actually "morphing dangling

by rfoo 4y ago

> they are halfway to implementing a garbage collector already This is a common misunderstanding. The key insight of this work is actually "morphing dangling pointers into memory leaks is WAY EASIER than automatic memory management (a.l.a. GC or refcount)". As long as we still do memory management by hand, we are able to avoid most of the complexity of GC (or defects of RC) and convert one bug class to another without much overhead. Yes, this work can't eliminate bugs in your code (unlike, say, Rust, or other GC languages). But some bugs matter more than others, and, it works on existing code, it makes significant contribution to security without rewriting the world with Rust or JavaScript.

pjmlp 4y ago
Yeah, that's the thing, there are some domains that aren't going to ever move away from C and C++ dynamic duo no matter what, at least until something like quantum takes over (how many decades still?), so any help to improve their security is welcomed.
- tialaramex 4y ago
  > aren't going to ever move away from C and C++ dynamic duo no matter what Forever is a long time. > any help to improve their security is welcomed. I'm less certain of this than you are, after decades of watching "We may not have really solved the problem, but this helps 99%" almost immediately followed by "Oh, our adversaries apparently aren't idiots and so our 99% mitigation did not actually reduce our burden significantly". For domains where you don't have security considerations, this is fine. If you make single player video games a mitigation which means you have 4 crash bugs to fix in your game instead of 400 is excellent news. The bugs aren't trying to catch you, so mitigations are effective. But in security your attackers will put no effort into cutting through your expensive thick steel reinforced concrete wall, and focus their effort instead on picking the $4 padlock on your gate in that wall or vaulting over the wall, or just say they're a package delivery and drive in past your guards or a dozen other things you never thought of.
  - pjmlp 4y ago
    Until stuff like CUDA, DirectX, LibGNM, LLVM, GCC, mainstream language runtimes, UNIX clones, IBM mainframes, Windows, Machine Learning, HPC stuff like MPI and OpenAAC, move away from C and C++, I will stay with my forever statement. Your game development example, other than Embark Studios, very few care about. Not to mention that Unreal, Unity, Godot are the bare minimum to beat. AAA game companies that are security conscious are already using .NET, Java, Go on their game servers.
    - tialaramex 4y ago
      > Until [...] I will stay with my forever statement. That's not how forever works. As to the specifics, there's some sign that things like the GPU APIs are realising they did care about memory safety after all - when the problem caused by a memory safety bug is that some particle effects look a bit wonky every tenth frame in a game and you find zeroing the Z buffer fixes it even though it logically shouldn't that's never getting off the backlog, but when it causes your $10M compute cluster to spit out bogus results unless you reboot it between runs that's $$$ wasted. I fully expect that for a while they will be enthusiastic about all the other things that attracted people who eventually end up with Rust - they'll purchase static checkers, they'll write code in a different style, they'll invest in more sophisticated debugging tools, but there's a reason Rust happened. For the compilers, well, I'm old, twenty years ago I was a full-time C programmer, today nobody would do what we did in C back then, maybe they'd try in C++? But the thing which initially attracted people to C++ was that whole "Won't do better without hand-rolled machine code" and that has rotted pretty badly even in twenty years because of... drum roll, ABI compatibility. The compiler vendors care about performance, long after apparently many C++ programmers are content to produce code with similar performance to Python for ten times the cost and a fraction of the safety, the compiler vendors are still under pressure to ship stuff that has decent performance but also correctness. Rust looks like a better fit for that every year.

by rfoo 4y ago

pjmlp 4y ago

Yeah, that's the thing, there are some domains that aren't going to ever move away from C and C++ dynamic duo no matter what, at least until something like quantum takes over (how many decades still?), so any help to improve their security is welcomed.

tialaramex 4y ago
> aren't going to ever move away from C and C++ dynamic duo no matter what Forever is a long time. > any help to improve their security is welcomed. I'm less certain of this than you are, after decades of watching "We may not have really solved the problem, but this helps 99%" almost immediately followed by "Oh, our adversaries apparently aren't idiots and so our 99% mitigation did not actually reduce our burden significantly". For domains where you don't have security considerations, this is fine. If you make single player video games a mitigation which means you have 4 crash bugs to fix in your game instead of 400 is excellent news. The bugs aren't trying to catch you, so mitigations are effective. But in security your attackers will put no effort into cutting through your expensive thick steel reinforced concrete wall, and focus their effort instead on picking the $4 padlock on your gate in that wall or vaulting over the wall, or just say they're a package delivery and drive in past your guards or a dozen other things you never thought of.
- pjmlp 4y ago
  Until stuff like CUDA, DirectX, LibGNM, LLVM, GCC, mainstream language runtimes, UNIX clones, IBM mainframes, Windows, Machine Learning, HPC stuff like MPI and OpenAAC, move away from C and C++, I will stay with my forever statement. Your game development example, other than Embark Studios, very few care about. Not to mention that Unreal, Unity, Godot are the bare minimum to beat. AAA game companies that are security conscious are already using .NET, Java, Go on their game servers.
  - tialaramex 4y ago
    > Until [...] I will stay with my forever statement. That's not how forever works. As to the specifics, there's some sign that things like the GPU APIs are realising they did care about memory safety after all - when the problem caused by a memory safety bug is that some particle effects look a bit wonky every tenth frame in a game and you find zeroing the Z buffer fixes it even though it logically shouldn't that's never getting off the backlog, but when it causes your $10M compute cluster to spit out bogus results unless you reboot it between runs that's $$$ wasted. I fully expect that for a while they will be enthusiastic about all the other things that attracted people who eventually end up with Rust - they'll purchase static checkers, they'll write code in a different style, they'll invest in more sophisticated debugging tools, but there's a reason Rust happened. For the compilers, well, I'm old, twenty years ago I was a full-time C programmer, today nobody would do what we did in C back then, maybe they'd try in C++? But the thing which initially attracted people to C++ was that whole "Won't do better without hand-rolled machine code" and that has rotted pretty badly even in twenty years because of... drum roll, ABI compatibility. The compiler vendors care about performance, long after apparently many C++ programmers are content to produce code with similar performance to Python for ten times the cost and a fraction of the safety, the compiler vendors are still under pressure to ship stuff that has decent performance but also correctness. Rust looks like a better fit for that every year.