6 ms·

Zig is going to be the new Rust for some people

by szundi 3y ago

pjmlp 3y ago
Except it is being used here as a wrapper for C and C++ clang packaging. Also as remark, Zig is going to be the new Modula-2, with revamped syntax for C minded folks, and compile time support. Assuming it takes off post 1.0, still a long to go in the adoption chasm graph.
- ZoomZoomZoom 3y ago
  I'm sorry to inform, but the new Modula-2 is already Nim, isn't it?
  - pjmlp 3y ago
    Not really, that is more like a compiled Python.
    - ZoomZoomZoom 3y ago
      It's like saying a lizard is closer to a table than to a snake, because it has legs.
      - xeonmc 3y ago
        But he is saying it’s closer to a snake though...?
laerus 3y ago
Zig is not memory safe.
- dragonelite 3y ago
  Is it memory safe enough and if it helps mitigating other kinds of errors without being in the way. It will find its place in the programming world. I think what zig really needs is something like the rust Axum ecosystem for web backend development. I would never be able to make a zig case at work without those sort of frameworks. People would say why zig without web related packages when you also have GOlang.
  - pjmlp 3y ago
    A recipe for CVE waiting to happen, plugging a memory-safe-enough into the Internet, for someone to take advantage of a UAF that wasn't tested.
    - flohofwoe 3y ago
      The browser's WASM runtime is already a safe sandbox. There's really not much point in 'double sandboxing' both on the language and runtime level.
      - pjmlp 3y ago
        If that is the only place Zig is ever going to be used, then no worries, I guess. WebAssembly sandboxes apparently are going to sort out all security issues in modern computing.
      - cygx 3y ago
        In order to be useful, a sandboxed program needs to communicate with the environment (the equivalent of system calls). If you can corrupt internal state, you can control the arguments to those calls, which may have security implications. For example, if you corrupt a program that's allowed to use web sockets, you'll be able to port scan the user's local network.
        flohofwoe 3y ago
        If that actually works in a browser wasm environment then it's also possible from Javascript, which is a memory safe language (eg either the sandbox works or it doesn't, that also includes the external APIs).
        cygx 3y ago
        Sure. Under that perspective, it's basically a new vector for XSS attacks.
      - IshKebab 3y ago
- logicchains 3y ago
  For some of the biggest C++ use cases, video games and HFT, this absolutely doesn't matter.

Zig is going to be the new Rust for some people

by szundi 3y ago

Zig is going to be the new Rust for some people

Except it is being used here as a wrapper for C and C++ clang packaging. Also as remark, Zig is going to be the new Modula-2, with revamped syntax for C minded folks, and compile time support. Assuming it takes off post 1.0, still a long to go in the adoption chasm graph.

ZoomZoomZoom 3y ago
I'm sorry to inform, but the new Modula-2 is already Nim, isn't it?
- pjmlp 3y ago
  Not really, that is more like a compiled Python.
  - ZoomZoomZoom 3y ago
    It's like saying a lizard is closer to a table than to a snake, because it has legs.
    - xeonmc 3y ago
      But he is saying it’s closer to a snake though...?

laerus 3y ago

Zig is not memory safe.

dragonelite 3y ago
Is it memory safe enough and if it helps mitigating other kinds of errors without being in the way. It will find its place in the programming world. I think what zig really needs is something like the rust Axum ecosystem for web backend development. I would never be able to make a zig case at work without those sort of frameworks. People would say why zig without web related packages when you also have GOlang.
- pjmlp 3y ago
  A recipe for CVE waiting to happen, plugging a memory-safe-enough into the Internet, for someone to take advantage of a UAF that wasn't tested.
  - flohofwoe 3y ago
    The browser's WASM runtime is already a safe sandbox. There's really not much point in 'double sandboxing' both on the language and runtime level.
    - pjmlp 3y ago
      If that is the only place Zig is ever going to be used, then no worries, I guess. WebAssembly sandboxes apparently are going to sort out all security issues in modern computing.
    - cygx 3y ago
      In order to be useful, a sandboxed program needs to communicate with the environment (the equivalent of system calls). If you can corrupt internal state, you can control the arguments to those calls, which may have security implications. For example, if you corrupt a program that's allowed to use web sockets, you'll be able to port scan the user's local network.
      - flohofwoe 3y ago
        If that actually works in a browser wasm environment then it's also possible from Javascript, which is a memory safe language (eg either the sandbox works or it doesn't, that also includes the external APIs).
        cygx 3y ago
        Sure. Under that perspective, it's basically a new vector for XSS attacks.
    - IshKebab 3y ago
logicchains 3y ago
For some of the biggest C++ use cases, video games and HFT, this absolutely doesn't matter.