12 ms·
I’m afraid this might be too little, too late. But regardless whether I’m right or wrong, we all should welcome a widely used language trying to become a little
by ardel95 4y ago
I’m afraid this might be too little, too late. But regardless whether I’m right or wrong, we all should welcome a widely used language trying to become a little more safe.
- yazzku 4y agoOn the other hand, it appears to have a great bang/buck. Link existing programs against the hardened libc++ and get those checks for "free" (other than the perf hit.)
- jeffbee 4y agoI'm not at all clear on how exactly that would work. The entire program would have to be rebuilt from scratch, would it not? Things like std::vector::operator[] are not runtime library calls, they are almost always inlined by the compiler. You could not simply take an existing program, replace its runtime library, and get bounds-checked vector accesses.
- pjmlp 4y agoDepends how the linking took place, and optimization levels.
- planede 4y agovector is a template, at most vector<some_type>::operator[] will be a weak symbol, and I bet it's inlined from -O1 and above.
- gpderetta 4y agoEven if not inlined at -O0, when instantiated for a custom some_type, the standard library .so won't contain any code for it, everything will be in the application binary.
- pjmlp 4y agoDepends on the implementation of helper functions and if external templates are being used.
- pjmlp 4y agoOn Windows it can still live on a dynamic library. That has been a thing since the Windows 16 bit days, and other OSes with similar linking models like Symbian, OS/2 and AIX.
- jeffbee 4y agoIt’s difficult to imagine which applications would find the performance of an outline vector access acceptable. Generally vector::operator[] is represented in built programs by a single x86 mov. A call would wreck the performance. In languages with bounds-checked vectors, they don’t do it with library calls.
- pjmlp 4y agoI have practically always used bounds checked vectors and strings. In the old days, all C++ frameworks bundled with compilers tended to have bounds checking enabled by default (Turbo Vision, OWL, VCL, MFC, PowerPlant, CSet++, Qt,...). Nowadays I always set _ITERATOR_DEBUG_LEVEL to 1 on VC++, unless I am not allowed to. Mostly the performance problems that were dealt with, had to do with badly chosen algorithms and data structures. Modern Android ships with FORTIFY enabled. https://android-developers.googleblog.com/2017/04/fortify-in-android.html https://android-developers.googleblog.com/2017/04/fortify-in...
- gpderetta 4y agoOf course, it is a compiler feature, you will have to recompile and manually (or automatically) apply all suggested changes to the source code. If you just link against an hardened library, only the implementation of the (non inlined) library calls will be hardened, the user code itself won't see much benefits. Of course these days we have binary level optimizers, so who knows what it is possible in principle?
- yazzku 4y agoSorry, I used 'link' very liberally there, but you cleared it up. My point was that (from what I remember, it's been a few days) you'd mostly just need to recompile. As opposed to, you know, Rewrite It In Rust (TM).
- green_on_black 4y agoI agree. But the butthurt side of me wants to say: let those who wish for unsafety be unsafe.
- atoav 4y agoBut programming is multiplication. A programmers work multiplies. If some person once writes code that ends up leaking users data, that data might like a thousand users data in a way that cannot be unleaked. That broken code then multiplies through time. You would not say: Let those [civil engineers] who like unsafe bridges build unsafe bridges Because the people using them might not be able to judge the unsafety of the system. Because the work of programmers multiply we have a huge responsibility and a huge chance to improve the world.
- rapidlua 4y agoBut c’mon there’s no such thing as safe brain surgery. Would you then market brain surgeries as unsafe?
- rurban 4y agoActually working on safe brain surgery robots. It's marketed as safe, and the code is checked to be hard-realtime and safe.
- yakubin 4y agoYes? I wouldn’t even think that’s in any way controversial.
- samus 4y agoBad comparison. Brain surgeries are a method of last resort. They are unsafe because there are significant knowledge gaps in our understanding of the brain that might take centuries more to fill. Every time a neurosurgeon cuts, they are potentially doing irreversible damage to an important part of a person's consciousness, abilities and memories. Edit: and there is no way to prevent that damage except by detailed planning and by stopping to cut when the patient (under local anestesia) ceases talking or performing their craft. Other damage can only be detected later though.
- pjmlp 4y agoGiven that in many domains C++ will keep being the language to use, and most wannabe replacements depend on GCC and LLVM infrastructure (written in C++), any little bit of improved safety helps.
- rychco 4y agoToo late for what? C++ will continue to be used for decades.
- scrubs 4y agoIf C++ could, and I think with some respect and acknowledgement to others as having gotten it better, adopt two improvements: * library/language side: some domain of bullet proof memory * compiler/language side: move build dependencies into the compiler or something that frontends the compiler ala GO/Rust with a flag to enforce it so it's optional. Here don't let perfect be the enemy of the good. There'd need be some new keywords or namespaces to make this work. That'd be superb I have all kinds of chances and opportunities to learn Rust but our eco system is endless C/C++. So I'd rather not deal with another complicated language. There's no near term or medium term timeline to move even 20% into Rust. I bail out to GO for I/O bound work.
- maldev 4y agoThere's multiple frameworks which give bullet proof memory usages and other fixes through annotations. The most common being https://learn.microsoft.com/en-us/cpp/code-quality/understanding-sal?view=msvc-170 https://learn.microsoft.com/en-us/cpp/code-quality/understan... . People just dont use them besides kernel devs, and even then they don't really use it. I believe the entire MS kernel is written using this.
- pianoben 4y agoa) Not just the Windows kernel - Office uses SAL, too, in numerous places. Mostly in legacy places predating more modern C++. b) It's not true to say that kernel devs don't really use it. They use it a lot, though there are attempts at obsoleting some of it[0]. [0]: https://github.com/microsoft/wil https://github.com/microsoft/wil
- maldev 4y agoOh nice, I didn't know that about office, it makes sense though. I don't work for Microsoft and mainly work in the Antivirus space, so I only occasionally hear stories from friends about their internal stuff. When I said driver devs don't always use it, I mainly meant third party vendors writing kernel code. I know alot of the overseas places don't, and I've rarely had jobs which use it.