5 ms·

Doesn't C have years and years of repeated security flaws due to lack of memory safety? What's the motivation to continue releasing greenfield projects in C?

remexre 4y ago
Sounds like this is intended to run on targets rustc would not support, given the claim that it "does not assume 8-bit addressability". Also, while I'm fully on board the "Rust as a default userspace systems language," the machine code I've gotten out of trying #[no_std] Rust to write part of a bare-metal project was heinously bloated. This is without even using any non-libcore dependencies! Something like 3/4s of the machine instructions looked like they were related to building error messages for panics, despite the fact that there shouldn't have been any reachable panics (and the code was small and simple enough that I expected LLVM to be able to reason about this without any MIR-level optimizations). Maybe this would be better on a project that could use rustc as its linker, but based on this, I wouldn't necessarily recommend that a bare-metal library intended to be linked to C and hand-written assembly be written in Rust versus, say, verified with Frama-C or other C-specific tools.
- mananaysiempre 4y ago
  To be fair, the AVR and STM8 code I’ve got out of GCC and SDCC when feeding them normal (non-8-bitter-adapted) C also sucked—though not to the point of building strings—because the default promotion to int required by the standard really hurts when the minimum required 16-bit int does not fit into a register.
  - remexre 4y ago
    oh, yeah, I can totally imagine that; this was being built for AArch64 though; with all the Cortex-A features, even!
- higherhalf 4y ago
  I'm latching onto a non-main argument to be pedantic, but I'd like to mention that Rust is fine for _non-embedded_ kernel development too, in my experience. As you're likely aware, Rust for embedded sucks when there's no HAL, but should be pretty pleasant otherwise. Have you looked into the cortex-a[1] crate? Some unnecessary instructions could also be a part of an ongoing optimization effort[2][3]. [1]: https://github.com/rust-embedded/cortex-a https://github.com/rust-embedded/cortex-a [2]: https://old.reddit.com/r/rust/comments/yn6105/optimization_of_memcpys_in_rustc_and_llvm_16 https://old.reddit.com/r/rust/comments/yn6105/optimization_o... [3]: https://arewestackefficientyet.com https://arewestackefficientyet.com
girvo 4y ago
Rust’s embedded story still has some ways to go. There are a lot of targets out there. I’m hopeful medium-term, though.
keewee7 4y ago
Rust is wonderful technology that will make software more secure and reliable. However there is no sense of stability in the Rust world. APIs constantly break and most crates are pre-1.0.0.
matheusmoreira 4y ago
> What's the motivation to continue releasing greenfield projects in C? People like C. I like C. I like Rust too but I like C more.
- Gigachad 4y ago
  That doesn’t really cut it when you are dealing with security critical software. “I like C” won’t sound so good when someone finds an out of bounds exploit on your car update mechanism and manages to load a malicious firmware.
  - elcritch 4y ago
    Hmmm, on the flip side I do like it when a out-of-bounds exploit lets someone create a way for me to "root" my cars old firmware and upload community fixes. Of course it'd be better if the manufacturer let you upload new firmware, but alas.
goodpoint 4y ago
> Doesn't C have years and years of repeated security flaws No: not if you avoid memory-unsafe functions. The language does not automatically introduce vulnerabilities. C has a much smaller footprint and runs on thousands of architectures unsupported by other languages.
- yencabulator 4y ago
  No true Scotsman ever wrote a bug in C, eh?
  - goodpoint 4y ago
    Wrong.
- svnpenn 4y ago
  > No: not if you avoid memory-unsafe functions heres a shotgun with a hair trigger, now you be careful! shoots face off
  - goodpoint 4y ago
    This is not 4chan.
    - svnpenn 4y ago
      When you post a joke comment, don't be surprised if you get joke replies.
      - goodpoint 4y ago
        You can engage in a meaningful and civilized conversation or go back to 4chan.
        svnpenn 4y ago
        if you cant, then why should I?
jedisct1 4y ago
It was originally written for a project running on Arduino Uno, where every byte of code and memory counts. Stack usage, in particular, had to be very controlled. C and assembly were the only options. Zig didn't exist back then.

remexre 4y ago

Sounds like this is intended to run on targets rustc would not support, given the claim that it "does not assume 8-bit addressability". Also, while I'm fully on board the "Rust as a default userspace systems language," the machine code I've gotten out of trying #[no_std] Rust to write part of a bare-metal project was heinously bloated. This is without even using any non-libcore dependencies! Something like 3/4s of the machine instructions looked like they were related to building error messages for panics, despite the fact that there shouldn't have been any reachable panics (and the code was small and simple enough that I expected LLVM to be able to reason about this without any MIR-level optimizations). Maybe this would be better on a project that could use rustc as its linker, but based on this, I wouldn't necessarily recommend that a bare-metal library intended to be linked to C and hand-written assembly be written in Rust versus, say, verified with Frama-C or other C-specific tools.

mananaysiempre 4y ago
To be fair, the AVR and STM8 code I’ve got out of GCC and SDCC when feeding them normal (non-8-bitter-adapted) C also sucked—though not to the point of building strings—because the default promotion to int required by the standard really hurts when the minimum required 16-bit int does not fit into a register.
- remexre 4y ago
  oh, yeah, I can totally imagine that; this was being built for AArch64 though; with all the Cortex-A features, even!
higherhalf 4y ago
I'm latching onto a non-main argument to be pedantic, but I'd like to mention that Rust is fine for _non-embedded_ kernel development too, in my experience. As you're likely aware, Rust for embedded sucks when there's no HAL, but should be pretty pleasant otherwise. Have you looked into the cortex-a[1] crate? Some unnecessary instructions could also be a part of an ongoing optimization effort[2][3]. [1]: https://github.com/rust-embedded/cortex-a https://github.com/rust-embedded/cortex-a [2]: https://old.reddit.com/r/rust/comments/yn6105/optimization_of_memcpys_in_rustc_and_llvm_16 https://old.reddit.com/r/rust/comments/yn6105/optimization_o... [3]: https://arewestackefficientyet.com https://arewestackefficientyet.com

girvo 4y ago

Rust’s embedded story still has some ways to go. There are a lot of targets out there. I’m hopeful medium-term, though.

keewee7 4y ago

Rust is wonderful technology that will make software more secure and reliable. However there is no sense of stability in the Rust world. APIs constantly break and most crates are pre-1.0.0.

matheusmoreira 4y ago

> What's the motivation to continue releasing greenfield projects in C? People like C. I like C. I like Rust too but I like C more.

Gigachad 4y ago
That doesn’t really cut it when you are dealing with security critical software. “I like C” won’t sound so good when someone finds an out of bounds exploit on your car update mechanism and manages to load a malicious firmware.
- elcritch 4y ago
  Hmmm, on the flip side I do like it when a out-of-bounds exploit lets someone create a way for me to "root" my cars old firmware and upload community fixes. Of course it'd be better if the manufacturer let you upload new firmware, but alas.

goodpoint 4y ago

> Doesn't C have years and years of repeated security flaws No: not if you avoid memory-unsafe functions. The language does not automatically introduce vulnerabilities. C has a much smaller footprint and runs on thousands of architectures unsupported by other languages.

yencabulator 4y ago
No true Scotsman ever wrote a bug in C, eh?
- goodpoint 4y ago
  Wrong.
svnpenn 4y ago
> No: not if you avoid memory-unsafe functions heres a shotgun with a hair trigger, now you be careful! shoots face off
- goodpoint 4y ago
  This is not 4chan.
  - svnpenn 4y ago
    When you post a joke comment, don't be surprised if you get joke replies.
    - goodpoint 4y ago
      You can engage in a meaningful and civilized conversation or go back to 4chan.
      - svnpenn 4y ago
        if you cant, then why should I?

jedisct1 4y ago

It was originally written for a project running on Arduino Uno, where every byte of code and memory counts. Stack usage, in particular, had to be very controlled. C and assembly were the only options. Zig didn't exist back then.