4 ms·

> Should I take that to mean there is an unsafe release mode without the bounds check? Yes, it's called ReleaseFast. > It's 2023; I think we can afford a sing

> Should I take that to mean there is an unsafe release mode without the bounds check? Yes, it's called ReleaseFast. > It's 2023; I think we can afford a single branch to avoid UB, even in release mode. Zig has 3 release modes: ReleaseSafe, ReleaseFast, ReleaseSmall. If you want the safety checks, just use the first. It might even be $currentYear, but many of the latest AAA games still don't always run at more than 60fps on my fairly powerful machine and I sincerely hope they were built with all the optimizations enabled.

Maken 4y ago
That's probably because of the DRM.
AnIdiotOnTheNet 4y ago
And 60fps is the low end in an era where many monitors are 120-240hz. 4ms/frame is a pretty tight budget.
titzer 4y ago
> I sincerely hope they were built with all the optimizations enabled. Sure, but I don't agree that disabling safety checks is an "optimization". It is a regression in functionality that is betting on nothing going wrong. Bounds checks do not cost much[1]. Maybe if a bounds check disables vectorization[2]. [1] https://blog.readyset.io/bounds-checks/ https://blog.readyset.io/bounds-checks/ [2] https://github.com/matklad/bounds-check-cost https://github.com/matklad/bounds-check-cost There are a lot of techniques to remove bounds checks, e.g. in counted loops [3][4]. [3] https://ieeexplore.ieee.org/document/5381765 https://ieeexplore.ieee.org/document/5381765 [4] https://en.wikipedia.org/wiki/Bounds-checking_elimination https://en.wikipedia.org/wiki/Bounds-checking_elimination
- AnIdiotOnTheNet 4y ago
  If that's what you believe, you are free to enable them as the programmer. Programmers who disagree are likewise free not to. This can even be decided on a scope-by-scope basis if so desired.
  - titzer 4y ago
    If it's a program you wrote to run on your on hardware, feel free. But in reality most programmers write programs for other people's computers, or just write programs because it's fun or pays well, and then their work gets integrated into a larger whole at a much later date, and then it's run in contexts the original author never imagined, long after they move on. Safety checks catch the base-level logic bugs that would otherwise cause programs to go silently wrong and misbehave in complex and inscrutable ways. Disabling them is not just living dangerously, it's a moral hazard; the programmer doesn't suffer the consequences, users do. It's not your program or computer at risk, but someone else's. I don't know how as a profession we're so cavalier with shipping exposed whirling knives, but we are.
    - AnIdiotOnTheNet 4y ago
      > the programmer doesn't suffer the consequences, users do. The same is true of poorly performing programs. My computer's resources are not the programmers' to waste, yet they routinely do waste it to save themselves time[0]. > I don't know how as a profession we're so cavalier with shipping exposed whirling knives, but we are. That's a separate problem than not handcuffing programmers and forcing them into safety checks. Why should Zig force this? Like, I just don't even get what you're complaining about here. The default build mode and the recommended release one insert the check. Checks can additionally be enabled and disabled on a scope-by-scope basis. What exactly do you want? Just eliminate ReleaseFast as an option and give people more reasons to go back to footgun-laden C because it'll be the only way to eliminate a bounds check in a tight loop hot spot? [0] Yes, I know this isn't due to safety checks in the vast majority of circumstances, that's not the point. I have nothing against safety checks, my problem is with the mentality that it should not be possible to disable them. Even Rust has `unsafe`.
      - adamrezich 4y ago
        the mere naming of the keyword `unsafe` has been a wholly unintentional disaster for programming in general as more and more people use Rust, because "safe"/"safety"/"unsafe" are sort of emotionally-loaded words in English, and it's led to people to build mental heuristics about the pros and cons of "safe" and "unsafe" code which may be subtly incorrect. the language feature itself is completely reasonable of course, given the design decisions of the language, but as Andy said elsewhere in this comments thread: > Rust evangelists need to be careful because in their zeal they have started to cause subtle errors in the general knowledge of how computers work in young people's minds. Ironically it's a form of memory corruption. I'm not even a zig user or fan or anything and I don't have any real opinion about Rust, either, except for completely agreeing with this analysis based on how I've seen Rust evangelists talk online. I'm not sure what the solution to this is, but it seems like it's just going to get worse over time as Rust becomes more popular and gains market share.
- krona 4y ago
  Without bounds checks: game crashes, core dump. With bounds checks: game crashes, meaningless error message given to the user. What am I missing?
  - nordsieck 4y ago
    > What am I missing? Sometimes without bounds checking you get an exploit instead of a crash.
  - gaganyaan 4y ago
    The meaningless error message can be entered into Google and the user can find a thread about how to fix their specific problem instead of wading through endless threads of similar-but-unrelated problems.
  - ekimekim 4y ago
    With bounds checks: game crashes, meaningless error message given to the user. Without bounds checks: I join a multiplayer lobby, and the next thing I know my computer is part of a botnet. This isn't an imaginary fear, it has happened many times. Some examples from a brief search: https://gridinsoft.com/blogs/rce-vulnerability-in-gta-online/ https://gridinsoft.com/blogs/rce-vulnerability-in-gta-online... https://www.polygon.com/22898895/dark-souls-pvp-exploit-multiplayer-servers-remote-code-execution https://www.polygon.com/22898895/dark-souls-pvp-exploit-mult... https://security.gerhardt.link/RCE-in-Factorio/ https://security.gerhardt.link/RCE-in-Factorio/ I am not claiming all of these would've been prevented by bounds checking arrays, or even memory safety in general. The point is that security is not optional just because it's a game.
    - dxhdr 4y ago
      Now suppose your game runs in a WASM sandbox and re-run those scenarios. What do you gain from bounds checks? I'm not suggesting that shipping without bounds checks is wise or leads to a better product. However I do think with /some games/ security is basically not a concern.
      - 4y ago
- kristoff_it 4y ago
  btw note that you're arguing this point in a the thread of a blog post about a feature that is all about maintaining safety while not paying for it at runtime. There's an entire section dedicated to explaining this point.

Maken 4y ago

That's probably because of the DRM.

AnIdiotOnTheNet 4y ago

And 60fps is the low end in an era where many monitors are 120-240hz. 4ms/frame is a pretty tight budget.

titzer 4y ago

> I sincerely hope they were built with all the optimizations enabled. Sure, but I don't agree that disabling safety checks is an "optimization". It is a regression in functionality that is betting on nothing going wrong. Bounds checks do not cost much[1]. Maybe if a bounds check disables vectorization[2]. [1] https://blog.readyset.io/bounds-checks/ https://blog.readyset.io/bounds-checks/ [2] https://github.com/matklad/bounds-check-cost https://github.com/matklad/bounds-check-cost There are a lot of techniques to remove bounds checks, e.g. in counted loops [3][4]. [3] https://ieeexplore.ieee.org/document/5381765 https://ieeexplore.ieee.org/document/5381765 [4] https://en.wikipedia.org/wiki/Bounds-checking_elimination https://en.wikipedia.org/wiki/Bounds-checking_elimination

AnIdiotOnTheNet 4y ago
If that's what you believe, you are free to enable them as the programmer. Programmers who disagree are likewise free not to. This can even be decided on a scope-by-scope basis if so desired.
- titzer 4y ago
  If it's a program you wrote to run on your on hardware, feel free. But in reality most programmers write programs for other people's computers, or just write programs because it's fun or pays well, and then their work gets integrated into a larger whole at a much later date, and then it's run in contexts the original author never imagined, long after they move on. Safety checks catch the base-level logic bugs that would otherwise cause programs to go silently wrong and misbehave in complex and inscrutable ways. Disabling them is not just living dangerously, it's a moral hazard; the programmer doesn't suffer the consequences, users do. It's not your program or computer at risk, but someone else's. I don't know how as a profession we're so cavalier with shipping exposed whirling knives, but we are.
  - AnIdiotOnTheNet 4y ago
    > the programmer doesn't suffer the consequences, users do. The same is true of poorly performing programs. My computer's resources are not the programmers' to waste, yet they routinely do waste it to save themselves time[0]. > I don't know how as a profession we're so cavalier with shipping exposed whirling knives, but we are. That's a separate problem than not handcuffing programmers and forcing them into safety checks. Why should Zig force this? Like, I just don't even get what you're complaining about here. The default build mode and the recommended release one insert the check. Checks can additionally be enabled and disabled on a scope-by-scope basis. What exactly do you want? Just eliminate ReleaseFast as an option and give people more reasons to go back to footgun-laden C because it'll be the only way to eliminate a bounds check in a tight loop hot spot? [0] Yes, I know this isn't due to safety checks in the vast majority of circumstances, that's not the point. I have nothing against safety checks, my problem is with the mentality that it should not be possible to disable them. Even Rust has `unsafe`.
    - adamrezich 4y ago
      the mere naming of the keyword `unsafe` has been a wholly unintentional disaster for programming in general as more and more people use Rust, because "safe"/"safety"/"unsafe" are sort of emotionally-loaded words in English, and it's led to people to build mental heuristics about the pros and cons of "safe" and "unsafe" code which may be subtly incorrect. the language feature itself is completely reasonable of course, given the design decisions of the language, but as Andy said elsewhere in this comments thread: > Rust evangelists need to be careful because in their zeal they have started to cause subtle errors in the general knowledge of how computers work in young people's minds. Ironically it's a form of memory corruption. I'm not even a zig user or fan or anything and I don't have any real opinion about Rust, either, except for completely agreeing with this analysis based on how I've seen Rust evangelists talk online. I'm not sure what the solution to this is, but it seems like it's just going to get worse over time as Rust becomes more popular and gains market share.
krona 4y ago
Without bounds checks: game crashes, core dump. With bounds checks: game crashes, meaningless error message given to the user. What am I missing?
- nordsieck 4y ago
  > What am I missing? Sometimes without bounds checking you get an exploit instead of a crash.
- gaganyaan 4y ago
  The meaningless error message can be entered into Google and the user can find a thread about how to fix their specific problem instead of wading through endless threads of similar-but-unrelated problems.
- ekimekim 4y ago
  With bounds checks: game crashes, meaningless error message given to the user. Without bounds checks: I join a multiplayer lobby, and the next thing I know my computer is part of a botnet. This isn't an imaginary fear, it has happened many times. Some examples from a brief search: https://gridinsoft.com/blogs/rce-vulnerability-in-gta-online/ https://gridinsoft.com/blogs/rce-vulnerability-in-gta-online... https://www.polygon.com/22898895/dark-souls-pvp-exploit-multiplayer-servers-remote-code-execution https://www.polygon.com/22898895/dark-souls-pvp-exploit-mult... https://security.gerhardt.link/RCE-in-Factorio/ https://security.gerhardt.link/RCE-in-Factorio/ I am not claiming all of these would've been prevented by bounds checking arrays, or even memory safety in general. The point is that security is not optional just because it's a game.
  - dxhdr 4y ago
    Now suppose your game runs in a WASM sandbox and re-run those scenarios. What do you gain from bounds checks? I'm not suggesting that shipping without bounds checks is wise or leads to a better product. However I do think with /some games/ security is basically not a concern.
    - 4y ago
kristoff_it 4y ago
btw note that you're arguing this point in a the thread of a blog post about a feature that is all about maintaining safety while not paying for it at runtime. There's an entire section dedicated to explaining this point.