4 ms·

Not to mention the weird conclusion that since no language has 0, that isn't the goal. I'm not sure I understand the logic that you shouldn't at least _try_ to

by saghm 3y ago

Not to mention the weird conclusion that since no language has 0, that isn't the goal. I'm not sure I understand the logic that you shouldn't at least _try_ to not have any major security flaws. My interpretation of the CVE counts he mentions is that if your goal is zero, you might end up still having a few, but if your goal is just "few enough that people stop complaining about us being worse than other languages in a similar niche", you probably will end up not hitting that threshold either, which seems like a plausible explanation for how C++ is in this situation in the first place. The fact that he brings up C a bunch also seems like it could be related to this; it sort of feels like he's focusing too much on the idea of security as a competition between languages rather than something that's inherently worthwhile as a goal in its own right.

kllrnohj 3y ago
The point is that trying to hit 0 would be a huge breakage that would fragment the language, and there's no actual evidence to suggest such a thing is actually necessary. It's like your front door's lock. It doesn't have to be unpickable, unshimmable, absolutely secure. It just has to put up more of a fight than a brick through the window.
- jvanderbot 3y ago
  Yep yep. A better analogy might be that the door has to eliminate quick, quiet entry to the house since that would deter a huge majority of would-be burglars just due to the vastly increased danger of getting noticed. We have locks on windows, but rarely bars. We have alarms that trigger sirens, but rarely indoor locks. Eliminate quick and quiet, usually good enough.
- saghm 3y ago
  I think the problem with this analogy for me is that while you might not care to have your home be 100% impossible to break into, you _do_ want to aim for it to be broken into zero times a year. If my house got broken into 60 times a year for five years, and my neighbors got broken into 6 times a year for the same period, I still think my long-term goal would be to have my home _never_ broken into, even if it meant moving to a different neighborhood.
  - PH95VuimJjqBqy 3y ago
    right, so what you decide to do is quit your job and never leave the house so no one ever has the opportunity to break into your house. Does the cost of doing so justify being 100% secure? most people would say no.
    - shrimp_emoji 3y ago
      Quit my job? I'm remote bb BD The best of both worlds: performance and security. Brought to you by Rust. (Even though I actually write C++ from home...)
      - PH95VuimJjqBqy 3y ago
        ok that's a scenario I didn't fully consider, lmao. but humor aside, the point stands. safety/security is about tradeoffs.
        saghm 3y ago
        > safety/security is about tradeoffs I don't disagree with this, but I'm struggling to understand how aiming for zero CVEs would somehow be too onerous a tradeoff when six is reasonable. Assuming that nobody wants to have any CVEs in their codebase, the idea that ending up with six is reasonable but aiming for zero is preposterous sounds like another way of saying "it's easy to accidentally miss six future CVEs in your codebase". If that's the case, how can you have any degree of confidence that by aiming for six, you won't end up with 12 instead?
        PH95VuimJjqBqy 3y ago
        there's a reason people say things like "actions speak louder than words". It's easy to say "safety is about tradeoffs" but then when you follow it up with an insistent that no tradeoffs should be made it kind of makes it seem like you're just saying that to appear reasonable rather than actually being reasonable.
  - 3y ago
- steve1977 3y ago
  Or, to stay within the metaphor, more of a fight than the door of your neighbor.
pizlonator 3y ago
Yeah. What I like about the 100% memory safe goal is that it’s a falsifiable goal. Even the Rust style goal of “you’re memory safe if you do 100% rust and never use unsafe” has the nice property of being falsifiable. 98% memory safe is not a falsifiable goal. It gives the C++ designers the option of never actually fixing the problem while claiming they had by picking a sloppy way of measuring the “%”.
PH95VuimJjqBqy 3y ago
> Not to mention the weird conclusion that since no language has 0, that isn't the goal. I'm not sure I understand the logic that you shouldn't at least _try_ to not have any major security flaws. He addressed that, the cost of making it to 0 would be too great (C++ would have to break backwards compatibility) so we should try and be inline with other languages instead. I don't understand why you're acting as if he didn't make the point he made.
- saghm 3y ago
  > He addressed that, the cost of making it to 0 would be too great (C++ would have to break backwards compatibility) so we should try and be inline with other languages instead. > I don't understand why you're acting as if he didn't make the point he made. My confusion is that I'd expect breaking backwards compatibility to either be completely off the table or for the amount of breakage allowed to be up for debate. If you're not willing to break compatibility at all, I feel like the goal should be to shoot as low as possible without breaking anything; if it's possible to get as low as other languages, why stop there? If you're willing to sacrifice some backwards compatibility, why not be willing to break it a little more to eliminate the last few sources of unsafety?
  - PH95VuimJjqBqy 3y ago
    it's not clear to me that you read or understood the article, all of your posts certainly feel as if you didn't. He explained why 0 isn't the goal, you continue to act as if he didn't. I don't know where else this conversation can go without you going back and better understanding his actual point.
    - saghm 3y ago
      If the discussion requires that I find his explanation convincing rather than being able to think that it's not sufficient, then yeah, I guess there's nowhere else for it to go.

by saghm 3y ago

kllrnohj 3y ago

The point is that trying to hit 0 would be a huge breakage that would fragment the language, and there's no actual evidence to suggest such a thing is actually necessary. It's like your front door's lock. It doesn't have to be unpickable, unshimmable, absolutely secure. It just has to put up more of a fight than a brick through the window.

jvanderbot 3y ago
Yep yep. A better analogy might be that the door has to eliminate quick, quiet entry to the house since that would deter a huge majority of would-be burglars just due to the vastly increased danger of getting noticed. We have locks on windows, but rarely bars. We have alarms that trigger sirens, but rarely indoor locks. Eliminate quick and quiet, usually good enough.
saghm 3y ago
I think the problem with this analogy for me is that while you might not care to have your home be 100% impossible to break into, you _do_ want to aim for it to be broken into zero times a year. If my house got broken into 60 times a year for five years, and my neighbors got broken into 6 times a year for the same period, I still think my long-term goal would be to have my home _never_ broken into, even if it meant moving to a different neighborhood.
- PH95VuimJjqBqy 3y ago
  right, so what you decide to do is quit your job and never leave the house so no one ever has the opportunity to break into your house. Does the cost of doing so justify being 100% secure? most people would say no.
  - shrimp_emoji 3y ago
    Quit my job? I'm remote bb BD The best of both worlds: performance and security. Brought to you by Rust. (Even though I actually write C++ from home...)
    - PH95VuimJjqBqy 3y ago
      ok that's a scenario I didn't fully consider, lmao. but humor aside, the point stands. safety/security is about tradeoffs.
      - saghm 3y ago
        > safety/security is about tradeoffs I don't disagree with this, but I'm struggling to understand how aiming for zero CVEs would somehow be too onerous a tradeoff when six is reasonable. Assuming that nobody wants to have any CVEs in their codebase, the idea that ending up with six is reasonable but aiming for zero is preposterous sounds like another way of saying "it's easy to accidentally miss six future CVEs in your codebase". If that's the case, how can you have any degree of confidence that by aiming for six, you won't end up with 12 instead?
        PH95VuimJjqBqy 3y ago
        there's a reason people say things like "actions speak louder than words". It's easy to say "safety is about tradeoffs" but then when you follow it up with an insistent that no tradeoffs should be made it kind of makes it seem like you're just saying that to appear reasonable rather than actually being reasonable.
- 3y ago
steve1977 3y ago
Or, to stay within the metaphor, more of a fight than the door of your neighbor.

pizlonator 3y ago

Yeah. What I like about the 100% memory safe goal is that it’s a falsifiable goal. Even the Rust style goal of “you’re memory safe if you do 100% rust and never use unsafe” has the nice property of being falsifiable. 98% memory safe is not a falsifiable goal. It gives the C++ designers the option of never actually fixing the problem while claiming they had by picking a sloppy way of measuring the “%”.

PH95VuimJjqBqy 3y ago

> Not to mention the weird conclusion that since no language has 0, that isn't the goal. I'm not sure I understand the logic that you shouldn't at least _try_ to not have any major security flaws. He addressed that, the cost of making it to 0 would be too great (C++ would have to break backwards compatibility) so we should try and be inline with other languages instead. I don't understand why you're acting as if he didn't make the point he made.

saghm 3y ago
> He addressed that, the cost of making it to 0 would be too great (C++ would have to break backwards compatibility) so we should try and be inline with other languages instead. > I don't understand why you're acting as if he didn't make the point he made. My confusion is that I'd expect breaking backwards compatibility to either be completely off the table or for the amount of breakage allowed to be up for debate. If you're not willing to break compatibility at all, I feel like the goal should be to shoot as low as possible without breaking anything; if it's possible to get as low as other languages, why stop there? If you're willing to sacrifice some backwards compatibility, why not be willing to break it a little more to eliminate the last few sources of unsafety?
- PH95VuimJjqBqy 3y ago
  it's not clear to me that you read or understood the article, all of your posts certainly feel as if you didn't. He explained why 0 isn't the goal, you continue to act as if he didn't. I don't know where else this conversation can go without you going back and better understanding his actual point.
  - saghm 3y ago
    If the discussion requires that I find his explanation convincing rather than being able to think that it's not sufficient, then yeah, I guess there's nowhere else for it to go.