11 ms·

White House urges devs to switch to memory-safe programming languages

61 points by el_duderino 3y ago

JohnFen 3y ago
I hope we get an alternative than Rust, though. I understand that lots of people like the language, but I personally find it very unpleasant to use.
- NewJazz 3y ago
  What about it? What about other languages would you rather see?
  - JohnFen 3y ago
    I just find Rust to be very clumsy and high-friction. This isn't a technical criticism, merely a matter of personal taste. But I dislike Rust enough that I've decided that I won't take a job that requires me to use it. Rather than risk getting into an online argument about Rust, though, I'd prefer to focus on the idea that we should have more than one "memory-safe" language.
    - steveklabnik 3y ago
      For what it’s worth, the government stuff this article is based on absolutely focused on the category at large, and not just Rust.
      - bigfishrunning 3y ago
        Being the government, I assume they want to give Ada another go
        steveklabnik 3y ago
        Ada is mentioned surprisingly little, to be honest. I think that everyone remembers The Ada Mandate and its failure.
    - pgwhalen 3y ago
      > I'd prefer to focus on the idea that we should have more than one "memory-safe" language. The very very large majority of code written today is done so in a memory-safe language. C/C++ is the only mainstream exception. The reasons we associate the phrase "memory-safe" with rust is 1) memory safety has been a solved problems for decades for most programming languages, so we forgot about it, and 2) it was _not_ a solved problem for "systems" languages like C/C++ that rust is directly trying to steal market share from.
- fancyfredbot 3y ago
  There are an awful lot of memory safe languages. For example Python, Java, JavaScript, and the safe subset of C#. Rust just happens to achieve memory safety with a relatively low runtime overhead.
  - JohnFen 3y ago
    That's a good point. I was thinking of compiled languages and so wasn't thinking about those.
    - IshKebab 3y ago
      There are memory safe compiled languages too, e.g. Go or Dart. I think Java and maybe C# can be AoT compiled too these days.
      - jeremyjacob 3y ago
        As well as Nim and Swift
      - pjmlp 3y ago
        Java and C# have been AOT compiled from yearly days as well, the difference to today was for Java AOT compilers were only available in commercial JDKs, and NGEN only supported dynamic linking, while being designed for fast startup times only.
  - silisili 3y ago
    The paper specifically eliminates languages with garbage collectors, however.
    - bpicolo 3y ago
      Seems to specifically include them? https://media.defense.gov/2023/Apr/27/2003210083/-1/-1/0/CSI_SOFTWARE_MEMORY_SAFETY_V1.1.PDF https://media.defense.gov/2023/Apr/27/2003210083/-1/-1/0/CSI...
- sBqQu3U0wH 3y ago
  I have a similar opinion. What puts me off about the language is it's horrendously ugly syntax and toxic, cult-like community (maybe these types are a minority, but they are awfully loud).
  - calamari4065 3y ago
    It's like someone took C, Python, and Perl, extracted the worst parts of all three and jammed them into one hellish language. There's not one thing about rust syntax that I enjoy. It's probably the worst out of any language I've tried, including Perl. I would rather read someone else's Perl script than Rust. It's very much one of these new-age languages that feel the need to reinvent every wheel and invent entirely new syntactical idioms just so they can be different. And yeah, the "just use rust, pleb" attitude is also super offputting. I'm not interested in dealing with people like that when I'm learning a language. I have plenty of much, much less terrible options.
    - zkldi 3y ago
      Could you give any examples of syntax you've hit that didn't make sense or seemed awful?
      - calamari4065 3y ago
        Sure, "let foo = bar" is one of the worst things any language can do. Let is redundant, that's what the = is for. Unless it's meant to be equivalent to 'var' or 'auto', in which case it's even worse. Let contains no information, it's pointless clutter that replaced something that did contain vital information. Let tells you the next symbol is a variable. What type? Who knows and who cares, it's a variable, deal with it. C marks a symbol as a variable by using its type name. I mean, this was a very large part of why Perl is so miserable. I will never understand why people choose to implement this in modern languages. Anyway, variables and parameters without explicit, visible type information is a hard no for me. I took a sniff of a couple rust projects, saw this mess, and decided that rust is not for me. I don't care about all the other magical benefits that cure all my ails, this feature is a dealbreaker, full stop.
- alex_lav 3y ago
  Bold take to discuss this on the internet. I agree entirely, but my gripes are generally met with the software dev's version of "git gud".
- wilg 3y ago
  Swift!
- jamesrr39 3y ago
  Not sure why either why the article just gives Rust as an example. Whilst there are some performance demanding use cases where Rust/C/C++ are really the appropriate choices, >99% of applications that have been written and are out there are not really worried about shaving the nanoseconds off or GC-pauses and are working just fine and memory-safe on Java/C#/Go/Python/Javascript/Ruby/PHP etc...
- crq-yml 3y ago
  Memory safety in a general sense of "just" computing things and getting an answer has been solved for a long while by using either garbage collection or static, bounds-checked, allocation with handles and liveness checks. It's the intermediate space where you can allocate byte buffers and make pointer structures willy-nilly that is troublesome, and idiomatic C sends you in that direction like flypaper. Rust is useful in addressing that specific space - with qualification, since of course it concedes to pragmatism and lets you do an "unsafe" where you want to break the rules. But I believe the future of low-level is more in the realm of original open-hardware designs, because you CAN design a computer that builds in the kinds of runtime checks that are currently done in software. It just isn't the focus of companies that want to sell a lot of bells-and-whistles silicon.
- begueradj 3y ago
  It seems you are not alone: https://www.infoworld.com/article/3713264/rust-developers-concerned-about-complexity-low-usage.html https://www.infoworld.com/article/3713264/rust-developers-co...
mikece 3y ago
[flagged]
- AdamJacobMuller 3y ago
  The debt amount is so surreal that you mixed up the units (it's 33 trillion not 33 billion) and also you missed an entire trillion dollars (it's 34 trillion not 33 trillion) or maybe it just went up by a trillion since you wrote that message.
  - mikece 3y ago
    You're right... I meant trillions. Geez -- the numbers are almost make-believe at this point.
    - paradox460 3y ago
      They are make believe. The number isn't real. Because if they default, so what? Nothing truly dire will happen, because they still have the ability to project a fantastic amount of force anywhere on earth.
- noahtallen 3y ago
  It's very different from normal entities being in debt, and likely not the same decision makers involved as those discussing software practices.
  - justonenote 3y ago
    Of course its very different than normal entities being in debt, since the government is ostensibly an arm of the people, who's income comes from taxing the populace. But it _is_ still debt right? It is still money owed. It is still money that was spent by the government by taking loans and promising to pay back those loans, again on behalf of the people. Once in a while, might be worth questioning who they borrowed the money from, what they spent it on, and who they chose to spend it with. Rather than just blindly repeat the pithy line, "but its not the same as regulars people's debt". The fact the gov can go 34 trillion in debt and a normal Joes Garage can't is actually pretty obvious to people already.
marcofrancesco 3y ago
[dead]
alex_lav 3y ago
Note that Rust isn't brought up in the video being discussed, and I've not actually found the source being referenced when the article says > The White House Office of the National Cyber Director (ONCD) urged tech companies today to switch to memory-safe programming languages, such as Rust, Happy to have missed it, but this seems to be a Rust fan injecting bias? The report being referenced in Dec 2023 recommends these languages: > Recommended memory safe programming languages mentioned in the CSI include C#, Go, Java, Python, Rust, and Swift. Software manufacturers should evaluate multiple memory safe programming languages before integrating them into their workflows.
- chc4 3y ago
  https://www.whitehouse.gov/wp-content/uploads/2024/02/Final-ONCD-Technical-Report.pdf https://www.whitehouse.gov/wp-content/uploads/2024/02/Final-... uses Rust as an example of a memory safe language that meets low-overhead requirements, such as for aerospace.
MenhirMike 3y ago
Could the White House do a bit more, like requiring ALL government contractors/projects to exclusively use memory-safe programming languages? I know they are already big on Ada, but I don't know if that is still a thing for new developments.
- acdha 3y ago
  My understanding is that Ada was mostly a DoD phenomenon. In my experience in the civilian side you’re going to find lots of things which are already memory-safe (Java, PHP, Python, JavaScript, etc.) so while I’d like to see strong support for it there I’d also look for other measures like ease of patching, good use of modern isolation primitives, etc.
- compressedgas 3y ago
  SPARK https://www.adacore.com/about-spark https://www.adacore.com/about-spark
jl2718 3y ago
Or use a C++ linter that disallows raw pointers, non-const references etc. There’s more, but, it’s mostly a subset of the language, although I admit some common syntax can get bloated this way. https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2023/p2739r0.pdf https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2023/p27...
- UncleMeat 3y ago
  It's a lot more than that. You can have a use after free by taking a const reference to a stack allocated value and returning it. You can happily have buffer overruns on data structures like std::vector. You can have use after frees through misuse of smart pointers. You can have all sorts of fun problems through invalid casts. The rules to actually subset c++ in a way that is safe by construction are actually way more harsh than commonly presented and Bjarne's proposal is, in my opinion, nowhere near strong enough to actually achieve it.
yzemmour 3y ago
as a javascript developer, I want to know what is the main difference between Rust and JavaScript regarding memory safety. - javascript utilizes a form of automatic memory management known as garbage collection (GC). The purpose of a garbage collector is to monitor memory allocation and determine when a block of allocated memory is no longer needed and reclaim it. what about Rust?
- bigfishrunning 3y ago
  Rust is fairly unique in that it uses a "Borrow Checker" to verify memory safety at compile time. Garbage collection has a definite performance cost, which Rust avoids.
  - yzemmour 3y ago
    thank you
- seanmcdirmid 3y ago
  Rust relies on static memory safety. In general you want both static and dynamic, but you can take a static type safe language and run it in processes with isolated address spaces. GC is largely orthogonal to memory safety, although it is really hard to implement GC in languages that don't have static type safety (although not impossible).
  - yzemmour 3y ago
    thank you

61 points by el_duderino 3y ago

I hope we get an alternative than Rust, though. I understand that lots of people like the language, but I personally find it very unpleasant to use.

NewJazz 3y ago
What about it? What about other languages would you rather see?
- JohnFen 3y ago
  I just find Rust to be very clumsy and high-friction. This isn't a technical criticism, merely a matter of personal taste. But I dislike Rust enough that I've decided that I won't take a job that requires me to use it. Rather than risk getting into an online argument about Rust, though, I'd prefer to focus on the idea that we should have more than one "memory-safe" language.
  - steveklabnik 3y ago
    For what it’s worth, the government stuff this article is based on absolutely focused on the category at large, and not just Rust.
    - bigfishrunning 3y ago
      Being the government, I assume they want to give Ada another go
      - steveklabnik 3y ago
        Ada is mentioned surprisingly little, to be honest. I think that everyone remembers The Ada Mandate and its failure.
  - pgwhalen 3y ago
    > I'd prefer to focus on the idea that we should have more than one "memory-safe" language. The very very large majority of code written today is done so in a memory-safe language. C/C++ is the only mainstream exception. The reasons we associate the phrase "memory-safe" with rust is 1) memory safety has been a solved problems for decades for most programming languages, so we forgot about it, and 2) it was _not_ a solved problem for "systems" languages like C/C++ that rust is directly trying to steal market share from.
fancyfredbot 3y ago
There are an awful lot of memory safe languages. For example Python, Java, JavaScript, and the safe subset of C#. Rust just happens to achieve memory safety with a relatively low runtime overhead.
- JohnFen 3y ago
  That's a good point. I was thinking of compiled languages and so wasn't thinking about those.
  - IshKebab 3y ago
    There are memory safe compiled languages too, e.g. Go or Dart. I think Java and maybe C# can be AoT compiled too these days.
    - jeremyjacob 3y ago
      As well as Nim and Swift
    - pjmlp 3y ago
      Java and C# have been AOT compiled from yearly days as well, the difference to today was for Java AOT compilers were only available in commercial JDKs, and NGEN only supported dynamic linking, while being designed for fast startup times only.
- silisili 3y ago
  The paper specifically eliminates languages with garbage collectors, however.
  - bpicolo 3y ago
    Seems to specifically include them? https://media.defense.gov/2023/Apr/27/2003210083/-1/-1/0/CSI_SOFTWARE_MEMORY_SAFETY_V1.1.PDF https://media.defense.gov/2023/Apr/27/2003210083/-1/-1/0/CSI...
sBqQu3U0wH 3y ago
I have a similar opinion. What puts me off about the language is it's horrendously ugly syntax and toxic, cult-like community (maybe these types are a minority, but they are awfully loud).
- calamari4065 3y ago
  It's like someone took C, Python, and Perl, extracted the worst parts of all three and jammed them into one hellish language. There's not one thing about rust syntax that I enjoy. It's probably the worst out of any language I've tried, including Perl. I would rather read someone else's Perl script than Rust. It's very much one of these new-age languages that feel the need to reinvent every wheel and invent entirely new syntactical idioms just so they can be different. And yeah, the "just use rust, pleb" attitude is also super offputting. I'm not interested in dealing with people like that when I'm learning a language. I have plenty of much, much less terrible options.
  - zkldi 3y ago
    Could you give any examples of syntax you've hit that didn't make sense or seemed awful?
    - calamari4065 3y ago
      Sure, "let foo = bar" is one of the worst things any language can do. Let is redundant, that's what the = is for. Unless it's meant to be equivalent to 'var' or 'auto', in which case it's even worse. Let contains no information, it's pointless clutter that replaced something that did contain vital information. Let tells you the next symbol is a variable. What type? Who knows and who cares, it's a variable, deal with it. C marks a symbol as a variable by using its type name. I mean, this was a very large part of why Perl is so miserable. I will never understand why people choose to implement this in modern languages. Anyway, variables and parameters without explicit, visible type information is a hard no for me. I took a sniff of a couple rust projects, saw this mess, and decided that rust is not for me. I don't care about all the other magical benefits that cure all my ails, this feature is a dealbreaker, full stop.
alex_lav 3y ago
Bold take to discuss this on the internet. I agree entirely, but my gripes are generally met with the software dev's version of "git gud".
wilg 3y ago
Swift!
jamesrr39 3y ago
Not sure why either why the article just gives Rust as an example. Whilst there are some performance demanding use cases where Rust/C/C++ are really the appropriate choices, >99% of applications that have been written and are out there are not really worried about shaving the nanoseconds off or GC-pauses and are working just fine and memory-safe on Java/C#/Go/Python/Javascript/Ruby/PHP etc...
crq-yml 3y ago
Memory safety in a general sense of "just" computing things and getting an answer has been solved for a long while by using either garbage collection or static, bounds-checked, allocation with handles and liveness checks. It's the intermediate space where you can allocate byte buffers and make pointer structures willy-nilly that is troublesome, and idiomatic C sends you in that direction like flypaper. Rust is useful in addressing that specific space - with qualification, since of course it concedes to pragmatism and lets you do an "unsafe" where you want to break the rules. But I believe the future of low-level is more in the realm of original open-hardware designs, because you CAN design a computer that builds in the kinds of runtime checks that are currently done in software. It just isn't the focus of companies that want to sell a lot of bells-and-whistles silicon.
begueradj 3y ago
It seems you are not alone: https://www.infoworld.com/article/3713264/rust-developers-concerned-about-complexity-low-usage.html https://www.infoworld.com/article/3713264/rust-developers-co...

mikece 3y ago

[flagged]

AdamJacobMuller 3y ago
The debt amount is so surreal that you mixed up the units (it's 33 trillion not 33 billion) and also you missed an entire trillion dollars (it's 34 trillion not 33 trillion) or maybe it just went up by a trillion since you wrote that message.
- mikece 3y ago
  You're right... I meant trillions. Geez -- the numbers are almost make-believe at this point.
  - paradox460 3y ago
    They are make believe. The number isn't real. Because if they default, so what? Nothing truly dire will happen, because they still have the ability to project a fantastic amount of force anywhere on earth.
noahtallen 3y ago
It's very different from normal entities being in debt, and likely not the same decision makers involved as those discussing software practices.
- justonenote 3y ago
  Of course its very different than normal entities being in debt, since the government is ostensibly an arm of the people, who's income comes from taxing the populace. But it _is_ still debt right? It is still money owed. It is still money that was spent by the government by taking loans and promising to pay back those loans, again on behalf of the people. Once in a while, might be worth questioning who they borrowed the money from, what they spent it on, and who they chose to spend it with. Rather than just blindly repeat the pithy line, "but its not the same as regulars people's debt". The fact the gov can go 34 trillion in debt and a normal Joes Garage can't is actually pretty obvious to people already.

marcofrancesco 3y ago

[dead]

alex_lav 3y ago

Note that Rust isn't brought up in the video being discussed, and I've not actually found the source being referenced when the article says > The White House Office of the National Cyber Director (ONCD) urged tech companies today to switch to memory-safe programming languages, such as Rust, Happy to have missed it, but this seems to be a Rust fan injecting bias? The report being referenced in Dec 2023 recommends these languages: > Recommended memory safe programming languages mentioned in the CSI include C#, Go, Java, Python, Rust, and Swift. Software manufacturers should evaluate multiple memory safe programming languages before integrating them into their workflows.

chc4 3y ago
https://www.whitehouse.gov/wp-content/uploads/2024/02/Final-ONCD-Technical-Report.pdf https://www.whitehouse.gov/wp-content/uploads/2024/02/Final-... uses Rust as an example of a memory safe language that meets low-overhead requirements, such as for aerospace.

MenhirMike 3y ago

Could the White House do a bit more, like requiring ALL government contractors/projects to exclusively use memory-safe programming languages? I know they are already big on Ada, but I don't know if that is still a thing for new developments.

acdha 3y ago
My understanding is that Ada was mostly a DoD phenomenon. In my experience in the civilian side you’re going to find lots of things which are already memory-safe (Java, PHP, Python, JavaScript, etc.) so while I’d like to see strong support for it there I’d also look for other measures like ease of patching, good use of modern isolation primitives, etc.
compressedgas 3y ago
SPARK https://www.adacore.com/about-spark https://www.adacore.com/about-spark

jl2718 3y ago

Or use a C++ linter that disallows raw pointers, non-const references etc. There’s more, but, it’s mostly a subset of the language, although I admit some common syntax can get bloated this way. https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2023/p2739r0.pdf https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2023/p27...

UncleMeat 3y ago
It's a lot more than that. You can have a use after free by taking a const reference to a stack allocated value and returning it. You can happily have buffer overruns on data structures like std::vector. You can have use after frees through misuse of smart pointers. You can have all sorts of fun problems through invalid casts. The rules to actually subset c++ in a way that is safe by construction are actually way more harsh than commonly presented and Bjarne's proposal is, in my opinion, nowhere near strong enough to actually achieve it.

yzemmour 3y ago

as a javascript developer, I want to know what is the main difference between Rust and JavaScript regarding memory safety. - javascript utilizes a form of automatic memory management known as garbage collection (GC). The purpose of a garbage collector is to monitor memory allocation and determine when a block of allocated memory is no longer needed and reclaim it. what about Rust?

bigfishrunning 3y ago
Rust is fairly unique in that it uses a "Borrow Checker" to verify memory safety at compile time. Garbage collection has a definite performance cost, which Rust avoids.
- yzemmour 3y ago
  thank you
seanmcdirmid 3y ago
Rust relies on static memory safety. In general you want both static and dynamic, but you can take a static type safe language and run it in processes with isolated address spaces. GC is largely orthogonal to memory safety, although it is really hard to implement GC in languages that don't have static type safety (although not impossible).
- yzemmour 3y ago
  thank you