21 ms·
Nvidia Security Team: “What if we just stopped using C?”
- davidork 4y ago
- pjmlp 4y agoIf you bothered to read the link you would have found out that it is about firmware written in Ada/SPARK, that is even lower level than raw drivers.
- krylon 4y agoI didn't even read the link, but it points to Adacore, which is a not-very-subtle hint what language it's going to be about.
- P_I_Staker 4y ago
- oneplane 4y agoSomeone commented on that page: "Just use Rust, you stupid corporate normies." which seems a bit odd considering the different goals. The 'big deal' here seems to be formal verification, not just "something that is not C" which is what people appear to assume here. Something I suspect they focus on here is the boot ROM or the SEP RtOS, which is small enough to warrant this kind of scrutiny.
- Traubenfuchs 4y ago
- naikrovek 4y agocommenters like that have turned me off of rust entirely and completely.
- api 4y agoYou shouldn't use Linux then. Linux evangelists were far more obnoxious when Linux was first making the rounds. This is just how tech works and how tech people tend to behave.
- adimineman 4y ago:/
- TurboHaskal 4y agoDon't make me remember the Python evangelists back in the day when they were targeting Perl.
- naikrovek 4y agoI remember those fools. those people are why I won't use python even today, 20 yrs or so later. if python was 10% as good as they claimed, it would be the most wonderful creation of mankind, past and future, by a factor of three.
- Kon-Peki 4y agoLOL, I can still remember the python "enthusiast" who lived across the hall from me in the freshman dorm in 1996/97. He is forever etched in my brain. I ran into him at a bar in Indianapolis 10 years or so ago when our alma mater was in the Sweet Sixteen. Must have drunkenly passed along my email address. Because about a year ago, he sent me a link to an interview he had given about the new thing he was passionate about. I congratulated him and asked a few questions out of kindness. Yeah, the response was exactly what you could imagine. All future emails from him go directly to the trash. Some people
- marginalia_nu 4y agoJust because people tend to behave in an obnoxious way doesn't make it even an ounce more acceptable.
- 4y ago
- deleted 4y ago[deleted]
- zorgmonkey 4y agoThe timing of their POC being in 2018 makes me wonder if it was possibly a direct response to the boot ROM exploit disclosed by Kate Temkin in 2018 (https://www.ktemkin.com/faq-fusee-gelee/ https://www.ktemkin.com/faq-fusee-gelee/).
- nix23 4y agoI absolutely love AdaCore, last employer (~6 years ago) worked heavily with Ada and AdaCore, the support from them was just mind-blowing, sounds like a advertisement i know, but not often have i seen something like it..well maybe from SGI and DEC..longlong time ago.
- Keyframe 4y agoI like my Rust and furries as the saying goes, but Ada is the underrated language out there. It really has a lot of things doing well for it, is really nice to write shit in it and probably the AdaCore being a single entity behind modern chain is what's both good and bad behind it. Yes, GNAT.. but, same thing.
- uri4 4y ago> last employer (~6 years ago It does not sounds like ad, but like Fortran. Last Ada job I remember was mars rover in 90ties. Great but nothing for new hires!
- mogoh 4y agohttps://web.archive.org/web/20221107104951/https://blog.adacore.com/nvidia-security-team-what-if-we-just-stopped-using-c https://web.archive.org/web/20221107104951/https://blog.adac...
- deafpolygon 4y agoFive years later... "Welp, back to C because AMD's performance is overtaking ours."
- Raphael_Amiard 4y agoThis is about firmware, nothing to do with the performance of GPUs...
- wheybags 4y agoFirmware and drivers have a massive impact on the performance of GPUs. It's not just hardware.
- timbit42 4y agoThe article states they had no performance hit from switching to SPARK.
- sillysaurusx 4y agoIt’s rare to see a thread where everyone is simultaneously correct but talking past each other. None of you are mistaken.
- wheybags 4y agoI noticed this happening and just stopped replying :p
- thatwasunusual 4y agoThis is for _security_. https://www.slideshare.net/AdaCore/securing-the-future-of-safety-and-security-of-embedded-software https://www.slideshare.net/AdaCore/securing-the-future-of-sa...
- VHRanger 4y ago
- bullen 4y agoI'm dreaming of a C with only pointers that has an optional VM (with and without GC) and namespaces, string and stream included. You can cook your own (C++, WASM and Java), but if it was standardized and cross compatible. Also curious why so many dislike streams?
- wyldfire 4y ago> I'm dreaming of a C with only pointers that has an optional VM (with and without GC) and namespaces, string and stream included. It'd be really nice to be able to trigger some scope-exit behavior, too, IMO.
- bullen 4y agoDo you mean for Exception handling?
- alcover 4y agoMaybe parent hinted at what GCC extensions like __cleanup__ variable attribute do.
- wyldfire 4y agoIndeed: maybe not a full "RAII" kind of feature but at least something simple that allows the author to specify (around the same place where a resource allocation happened, e.g.) that some other symmetric behavior should take place on any scope exit point.
- bullen 4y agoHm, ok my take on this is unexperienced; I come from Java and only learned C++ recently: I would like to have heap inspection tools which a VM would give you. Then you can remove the VM if/when you need performance and have profiled memory enough.
- cookiengineer 4y ago
- sim7c00 4y ago
- throw0101a 4y ago"Be the change change you wish to see in the world." — Arleen Lorrance† † No Gandhi: https://quoteinvestigator.com/2017/10/23/be-change/ https://quoteinvestigator.com/2017/10/23/be-change/
- deleted 4y ago[deleted]
- rectang 4y agoI enjoyed reading this quoteinvestigator article, but the conclusion it reaches credits Arleen Lorrance: > In conclusion, Mohandas Gandhi did write a pertinent passage in 1913 that expressed a similar idea, but the popular modern saying is considerably more concise and forceful. QI believes Arleen Lorrance should receive credit for the expression she wrote in 1974.
- UltraViolence 4y agoThey talk about SPARK, but I never heard about it until now. Reading up on Wikipedia it seems an ADA derivative. I assumed they were switching to Rust, but that doesn't seem to be the case.
- Raphael_Amiard 4y agoSPARK allows you to formally prove that your code is correct according to a given specification. It can thus provides much stronger guarantees than what Rust would be able to provide. Similar technology exists for Rust, but it is much less advanced than SPARK is (https://github.com/xldenis/creusot https://github.com/xldenis/creusot)
- the_only_law 4y agoAda is one of those languages that I really like in theory, but don’t really get to use it because I’m usually better off picking something else (for any number of reasons, but right tool for the job, y’know)
- mark_l_watson 4y agoAda had many good ideas, but I can’t imagine using it for anything but existing large legacy code bases. I am impressed by the Swift language: nice REPL based development if you want that, typed, great support for Apple devices and some support for Linux.
- yjftsjthsd-h 4y agoEr, does Swift have any of Ada's safety properties or proof tooling?
- 3a2d29 4y agoIsn’t reference counting a type of garbage collection? I feel like you can’t put Swift in the world of Rust/Ada/C/C++
- q-big 4y ago> Isn’t reference counting a type of garbage collection? Reference counting leads to memory leaks if cycles occur. Garbage collection algorithms don't have this problem.
- jollyllama 4y agoSecurity teams 10 years ago: Hey, why are you using that library? Security teams today: Hey, why are you using that language?
- cookiengineer 4y agoOnce the same kind of programming mistakes reappear in every other library, all over again, you start to question the language paradigms. Humans are not good at programming. I've never seen a "done" C++ codebase in my life, maintainers are always too busy reinventing parts that had originally nothing to do with the feature scope of their library.
- jlarocco 4y ago> Humans are not good at programming. I've never seen a "done" C++ codebase in my life, maintainers are always too busy reinventing parts that had originally nothing to do with the feature scope of their library. No reason to limit to "C++" there. It's an industry wide problem with every language. Even in open source, if a repo hasn't had commits in the last week, most people treat it as a dead project.
- cxr 4y ago> if a repo hasn't had commits in the last week, most people treat it as a dead project By "most people", you mean GitHub-era folks who are secretly more interested in the things about the site that fulfill their social needs than they are interested in solving the problem that the software is supposed to be used for.
- treeman79 4y agoI can’t even imagine getting back into C and knowing where to begin to do it “right” and get to a useful level.
- jfhufl 4y agoI think that's the major problem with software engineering in general: when is software "done" ?
- Joel_Mckay 4y agoWhat if all problems were solvable by adding or removing a layer of abstraction? Perhaps, like any other tool-set... C has an optimal problem domain not everyone can understand, and it is often unrelated to llvm compilers. Those who failed to learn why C++ evolved into its current state, are simply doomed to naively make another iteration of the same tantalizing bad design choices. https://en.wikipedia.org/wiki/Second-system_effect https://en.wikipedia.org/wiki/Second-system_effect
- marcosdumay 4y agoHow will undefined operations change with your new layer of abstraction? Anyway, you are really claiming that a sandbox capable of running C programs will solve more problems than writing your code in Rust?
- Joel_Mckay 4y agoI am inferring languages like Rust are not a replacement, but rather focus on a different problem domain already addressed in higher level languages. Its not a complete waste of time, but I have yet to see a use-case only Rust features could better achieve. I am not smart, so may have missed something important. =)
- marcosdumay 4y ago> languages like Rust Hum... If you know other languages similar to Rust, I'm curious to know them. Maybe there is something better out there, but AFAIK, the closest thing in existence is C. > a different problem domain already addressed in higher level languages Things like device drivers and embedded software. It's also what people push into submission when they want high performance software, but this is always a hard thing to do. I do really not recommend you to use Rust if a higher level language solves your problem. > I have yet to see a use-case only Rust features could better achieve It helps achieving things like making sure your GPU driver fucking works, instead of doing what the nvidia driver does. Of course, this article is about a different way of making sure it works. One that requires a lot more of work, but can provide some assurances that Rust can't. It is also easier to apply over Rust than C, but neither are the best target for it.
- stephc_int13 4y agoAda is the better Rust :) I know the approach is not the same, but the goals are similar enough. And I think that Ada core principles are more useful and less "magical" for hardening code.
- mumblemumble 4y agoPerhaps more to the point, it sounds like SPARK is better suited to this particular use case. Some of the problems they're using SPARK to solve aren't even on Rust's radar.
- CivBase 4y agoI would actually really love Ada if it weren't for a couple extremely frustrating syntax decisions: using parentheses for both call arguments and array subscripts, and making parentheses optional for calls with no arguments. Those two decisions make it incredibly difficult to distinguish between function calls, variables, and array subscripts. I absolutely have to use an IDE for Ada as a result. Also, Title_Case_With_Underscores is just silly. Otherwise, I agree. Ada is pretty great. It deserves more love.
- sroussey 4y agoWhen I used Ada the IDE was vim. LoL. Actually, I wrote an optimizing compiler for Ada in C++. Also in vim.
- coolspot 4y agoHave you done all those things in vim simply because you couldn’t find how to exit from vim?
- hox007 4y agoBoth decisions to use parentheses for both arrays and argument lists and omitting parentheses for call with arguments come from Ada's design goals of supporting programming at large. While this is contrary to some other languages that focus on specifics of implementation, the decision isolated design intent from implementation details. The original "Rationale for the Ada programming language" book provides a lengthier discussion on these points. TLDR; The syntax is an intentional language design choice which puts capture of design intent in the forefront over implementation details.
- khiqxj 4y ago> 1999 > CPUs are now 1GHz > C is obsoleted outside small sections of code such as image processing > 23 years later > "What if we just stopped using C?"
- marcosdumay 4y agoThis is about image processing.
- khiqxj 4y agoin a JPEG implementation, there is 10 lines of code that need to be in C, assembly, etc, the rest can be any language.
- anuvrat1 4y agoOT: Please post an archived link in comments, especially for small blogs Edit: https://web.archive.org/web/20221107114522/https://blog.adacore.com/nvidia-security-team-what-if-we-just-stopped-using-c https://web.archive.org/web/20221107114522/https://blog.adac...
- docandrew 4y agoC is like asbestos. It was fine at what it did, good performance, but the safety problems outweigh them. The difference is that we _stopped using asbestos_ because it was unsafe. It’s still around but being replaced during renovations, and no new installations use it. For whatever reason with C there’s this huge emotional component to it. Safer alternatives exist. You’d rightfully laugh at a contractor who suggested asbestos is fine, if you make sure to use only highly-skilled installers who patch up the drywall so that no fibers can escape. But with C we say that all the time, and the CVEs keep piling up.
- jimlongton 4y ago> Safer alternatives exist. Sure, but do they have certified compilers for Functional Safety (ISO26262) development for Automotive or Medical applications? Rust does not, although there's a company working on it.
- docandrew 4y agoYes, the compiler used for the work described in the post: https://www.adacore.com/industries/automotive/iso26262 https://www.adacore.com/industries/automotive/iso26262
- sokoloff 4y agoThere are still industrial uses of asbestos today, because for some applications, there isn't a ready drop-in replacement. Uses where safer drop-in replacements were possible (shingles, automotive friction materials, flooring, insulation) have gone away. That might be a good comparison against "portable assembly", also known as C.
- xet7 4y agoThat PDF was slow to load, but here it is: https://web.archive.org/web/20221107153324/https://releases.wekan.team/ada/222559-adacore-nvidia-case-study-v5.pdf https://web.archive.org/web/20221107153324/https://releases.... https://releases.wekan.team/ada/222559-adacore-nvidia-case-study-v5.pdf https://releases.wekan.team/ada/222559-adacore-nvidia-case-s...
- 3a2d29 4y agoI was expecting this to be a rust article lol. Ada is more memory safe than rust technically, although with less devs using it.
- pornel 4y agoExcept dynamic memory allocation, which in Ada either needs a GC or is unsafe.
- 3a2d29 4y agoAnd rust is unsafe if you use unsafe rust (or even if you use Arc in safe rust and reference count incorrectly). Ada doesn’t use allocation, remaining 100% memory safe.
- pornel 4y agoArc in safe Rust won't let you cause use-after-free no matter how much you screw up.
- twic 4y ago> And rust is unsafe if you use unsafe rust (or even if you use Arc in safe rust and reference count incorrectly). I don't believe it's possible to cause unsafety using Arc in safe Rust. I don't know what "reference count incorrectly" means here. Could you explain?
- vitiral 4y agoI believe they are referring to memory leaks. Not really a "safety concern" as it will simply cause the application to crash (eventually).
- touisteur 4y agoErm it is perfectly possible to perform dynamic allocation in Ada. You have the 'new' keyword to allocate a new object of a type. You have the 'unchecked deallocation' mechanism. You have controlled types that deallocate when an object is out of scope. You have all sorts of weak references schemes in some libraries. You have storage pools to handle allocation specifics for a type. You have the secondary stack that handles returning objects of unknown-size-at-call-site. Most of those can be disabled though through the 'restriction' mechanism (look up Pragma Restriction which is very interesting in itself). SPARK itself can handle and prove some ownership properties but to the best of my knowledge isn't at the level of rust in memory safety on dynamically allocated memory.
- manv1 4y ago"What if you just stopped writing bad code?" "What if you used static analyzers to detect these issues before shipping?" "What if you put bounds checking into your functions to prevent this?" "What if you tested your software more effectively before shipping it?"
- tialaramex 4y ago> What if you just stopped writing bad code? This is a popular but useless question. The reality is that to err is human. At scale it's even worse because now you're not just accepting that you personally may be capable of mistakes when writing software, you might have made a mistake when hiring the people who in turn hire the programmers. Ouch. > What if you used static analyzers to detect these issues before shipping? In principle all the modern safer languages are in some sense is more static analysis. But the analysis is made possible in considerable measure through language design. If you insist on an unsafe language (like C or C++) then the analyser can't help much beyond "Don't use this language". Good advice. > What if you put bounds checking into your functions to prevent this? Bounds checks are a very small part of the problem. They're symptomatic (a language designed to do well at this will enforce bounds by one means or another) but not sufficient. > What if you tested your software more effectively before shipping it? You can't afford to actually test software thoroughly by its nature. You will only be able to test a microscopic fraction of possible system states, whether the softwawre works as intended under all the many other states remains unknown.
- leoh 4y agoI’ll never forget this neckbeard older dude in an algorithms course with me in College “C is the only good language. And you should use it for everything.” “Even web servers that power apps?” “How could you consider anything else?” During the same program (over ten years ago), someone came from Adobe and basically said “C/C++ are the source of the majority of our security bugs and would just go away with another language.” Change is hard folks
- ilyt 4y agoI wouldn't believe Adobe, company known for shit security practices for decades now, to be any authority on the subject. They'd cut themselves with safety scissors
- leoh 4y agoThey wouldn’t, but this was a pretty bright staff scientist iirc.
- stubish 4y agoA company isn't an authority on any subject. Employees though... I'd bet the survivors have stories the rest of us just wouldn't believe, straight from the trenches. World class experts on how to not do things.
- cameroncooper 4y agoI actually enjoy programming in C. I don't get to use it as much as I'd like to though. Almost all the work I do these days has some other language that makes more practical sense to use: JavaScript, Golang, Rust, etc. But coming from an ECE background I enjoy the low level nature of C.
- kshacker 4y agoThe problem is not the people who are proficient and enjoy the language. The problem is the people of the other kind who get told to do it for a living. I know the top level asbestos analogy (not mine) got shot down but let me try another. The problem is that we send both a trucker and cyclist to the freeway without any kind of protections for or against cyclist.
- NoZZz 4y agoNot this echo chamber again.
- generichuman 4y agoSince when is using SPARK an echo chamber?
- redtriumph 4y agoGetting a 504 when I click the link. Is anyone seeing this issue?
- LargoLasskhyfv 4y agoYes. OpenResty needs some rest. Give it time. 2 minutes, or so, after a click on reload.
- acomjean 4y agoConsider the source. Its Adacore, the support open source Ada. I know them from the Ada on x86 seminar they held at my employer (we were using Ada on PA-RISC). Nice people but pro Ada (or its "Spark" language which I guess is like Ada). But another huge issue is that C is the language used by the OS. If you want to use that OS functionality to allocate memory, do networking, IPC etc, you are using a C header file and calling into it. We had a binding library to making calling C from Ada easier, but its still an extra step. The good news is that other languages are starting to have some great libraries. Ada and Rust and a bunch of other languages are safer than C, and likely a better choice. Its just there is a lot of existing code to port over.
- user8501 4y agoIf we risk societal collapse because of buffer overflows, I think our society needs fixing, not our fun and sharp creative tools. Personally I think “what if we stopped using npm?” and “what if we stopped using cargo?” are much better security questions to be asking at this point.
- tyree731 4y agoThere may be better questions, but we aren't only allowed to ask the best possible question.
- brundolf 4y agoPossibly naive question from someone who's never worked with this kind of language, but something I've been wondering about: > it is possible to prove mathematically that your code behaves in precise accordance with its specification So that bridges from one thing to another; but what prevents flaws in the specification itself? Is it just simpler/easier to read than the code is, so they're easier to spot?
- csb6 4y ago> Is it just simpler/easier to read than the code is, so they're easier to spot? Kind of. You basically annotate your program with pre/post-conditions, then you run the program through a theorem prover, which attempts to prove all of your conditions are true in all cases. The basic guarantee is that if you pass the theorem prover, your code will be free of array out-of-bounds accesses, null pointer dereferences, integer overflow, divide by zero, and other runtime errors. These are useful security properties to prove always hold, and you don’t have to explicitly write specifications for them (just conditions to help the prover along). If you want to go further (prove functional correctness of your program), you can add more specifications. A lot of times you just want to prove some basic sanity checks hold 100% of the time (e.g. always return a sorted array). These can be pretty easy to specify correctly.
- unequiv88 4y agoThe security demands of a system depend on the use case. I’m not going to be importing all of Rust to tinker on an RPi. What if we accepted that not everyone is working on big tech corp problems?
- 0xbadcafebee 4y agoThis is literally a PR article from a company who sells SPARK products, talking about a company buying into SPARK. Please provide your own salt lick.
- kristianp 4y agoThey don't actually mention what SPARK is nor link to any product page. Not very useful self-promotion.
- Kukumber 4y ago> Performance compared to C: “I did not see any performance difference at all.” See? but have you measured it?