4 ms·

The point is that trying to hit 0 would be a huge breakage that would fragment the language, and there's no actual evidence to suggest such a thing is actually

The point is that trying to hit 0 would be a huge breakage that would fragment the language, and there's no actual evidence to suggest such a thing is actually necessary. It's like your front door's lock. It doesn't have to be unpickable, unshimmable, absolutely secure. It just has to put up more of a fight than a brick through the window.

jvanderbot 3y ago
Yep yep. A better analogy might be that the door has to eliminate quick, quiet entry to the house since that would deter a huge majority of would-be burglars just due to the vastly increased danger of getting noticed. We have locks on windows, but rarely bars. We have alarms that trigger sirens, but rarely indoor locks. Eliminate quick and quiet, usually good enough.
saghm 3y ago
I think the problem with this analogy for me is that while you might not care to have your home be 100% impossible to break into, you _do_ want to aim for it to be broken into zero times a year. If my house got broken into 60 times a year for five years, and my neighbors got broken into 6 times a year for the same period, I still think my long-term goal would be to have my home _never_ broken into, even if it meant moving to a different neighborhood.
- PH95VuimJjqBqy 3y ago
  right, so what you decide to do is quit your job and never leave the house so no one ever has the opportunity to break into your house. Does the cost of doing so justify being 100% secure? most people would say no.
  - shrimp_emoji 3y ago
    Quit my job? I'm remote bb BD The best of both worlds: performance and security. Brought to you by Rust. (Even though I actually write C++ from home...)
    - PH95VuimJjqBqy 3y ago
      ok that's a scenario I didn't fully consider, lmao. but humor aside, the point stands. safety/security is about tradeoffs.
      - saghm 3y ago
        > safety/security is about tradeoffs I don't disagree with this, but I'm struggling to understand how aiming for zero CVEs would somehow be too onerous a tradeoff when six is reasonable. Assuming that nobody wants to have any CVEs in their codebase, the idea that ending up with six is reasonable but aiming for zero is preposterous sounds like another way of saying "it's easy to accidentally miss six future CVEs in your codebase". If that's the case, how can you have any degree of confidence that by aiming for six, you won't end up with 12 instead?
        PH95VuimJjqBqy 3y ago
        there's a reason people say things like "actions speak louder than words". It's easy to say "safety is about tradeoffs" but then when you follow it up with an insistent that no tradeoffs should be made it kind of makes it seem like you're just saying that to appear reasonable rather than actually being reasonable.
- kllrnohj 3y ago
  Right, but security bugs don't all come from the language. They also come from logic errors. That's the "window" analogy here. If the language (door) is no longer the way people are getting into your house, then that's job done for addressing the language and you need other tools to focus on other issues that now are the problem.
steve1977 3y ago
Or, to stay within the metaphor, more of a fight than the door of your neighbor.

jvanderbot 3y ago

Yep yep. A better analogy might be that the door has to eliminate quick, quiet entry to the house since that would deter a huge majority of would-be burglars just due to the vastly increased danger of getting noticed. We have locks on windows, but rarely bars. We have alarms that trigger sirens, but rarely indoor locks. Eliminate quick and quiet, usually good enough.

saghm 3y ago

I think the problem with this analogy for me is that while you might not care to have your home be 100% impossible to break into, you _do_ want to aim for it to be broken into zero times a year. If my house got broken into 60 times a year for five years, and my neighbors got broken into 6 times a year for the same period, I still think my long-term goal would be to have my home _never_ broken into, even if it meant moving to a different neighborhood.

PH95VuimJjqBqy 3y ago
right, so what you decide to do is quit your job and never leave the house so no one ever has the opportunity to break into your house. Does the cost of doing so justify being 100% secure? most people would say no.
- shrimp_emoji 3y ago
  Quit my job? I'm remote bb BD The best of both worlds: performance and security. Brought to you by Rust. (Even though I actually write C++ from home...)
  - PH95VuimJjqBqy 3y ago
    ok that's a scenario I didn't fully consider, lmao. but humor aside, the point stands. safety/security is about tradeoffs.
    - saghm 3y ago
      > safety/security is about tradeoffs I don't disagree with this, but I'm struggling to understand how aiming for zero CVEs would somehow be too onerous a tradeoff when six is reasonable. Assuming that nobody wants to have any CVEs in their codebase, the idea that ending up with six is reasonable but aiming for zero is preposterous sounds like another way of saying "it's easy to accidentally miss six future CVEs in your codebase". If that's the case, how can you have any degree of confidence that by aiming for six, you won't end up with 12 instead?
      - PH95VuimJjqBqy 3y ago
        there's a reason people say things like "actions speak louder than words". It's easy to say "safety is about tradeoffs" but then when you follow it up with an insistent that no tradeoffs should be made it kind of makes it seem like you're just saying that to appear reasonable rather than actually being reasonable.
kllrnohj 3y ago
Right, but security bugs don't all come from the language. They also come from logic errors. That's the "window" analogy here. If the language (door) is no longer the way people are getting into your house, then that's job done for addressing the language and you need other tools to focus on other issues that now are the problem.

steve1977 3y ago

Or, to stay within the metaphor, more of a fight than the door of your neighbor.