3 ms·

You're not wrong, and that is very impressive. There's nothing like well-applied fuzzing to improve security. But I still don't think that makes Oxide's decisi

You're not wrong, and that is very impressive. There's nothing like well-applied fuzzing to improve security. But I still don't think that makes Oxide's decision or my comment necessarily invalid, if only because of an a priori decision to stick with Rust system-wide -- it raises the floor on software quality.

akira2501 2y ago
> it raises the floor on software quality. Languages cannot possibly do this.
- TimTheTinker 2y ago
  I believe TypeScript and Rust are both strong examples of languages that do this (for different reasons and in different ways). It's also possible for a language to raise the ceiling of software quality, and Zig is an excellent example. I'm thinking of "floors" and "ceilings" as the outer bounds of what happens in real, everyday life within particular software ecosystems in terms of software quality. By "quality" I mean all of capabilities, performance, and absence of problems. It takes a team of great engineers (and management willing to take a risk) to benefit from a raised ceiling. TigerBeetle[0] is an example of what happens when you pair a great team, great research, and a high-ceiling language. [0] https://tigerbeetle.com/ https://tigerbeetle.com/
  - akira2501 2y ago
    > possible for a language to raise the ceiling of software quality Cargo is widely recognized as low quality. The thesis fails within it's own standard packaging. It's possible for a language to be used by _more people_ and thus raise the quality _in aggregate_ of produced software but the language itself has no bearing on quality in any objective measure. > to benefit from a raised ceiling You're explicitly putting the cart before the horse here. The more reasonable assertion is that it takes good people to get good results regardless of the quality of the tool. Acolytes are uncomfortable saying this because it also destroys the negative case, which is, it would be impossible to write quality software in a previous generation language. > TigerBeetle[0] is an example Of a protocol and a particular implementation of that protocol. It has client libraries in multiple languages. This has no bearing on this point.
    - TimTheTinker 2y ago
      > The more reasonable assertion is that it takes good people to get good results regardless of the quality of the tool. That's totally true, and I never contradicted that. By "ceiling" I mean the limit of what is possible. A great team can do a lot more when they have great tools.
    - sophacles 2y ago
      > Cargo is widely recognized as low quality. Can you point me to both of: * why it's considered low quality * evidence of this "wide regard" Other than random weirdos who think allowing dependencies is a bad practice because you could hurt yourself, while extolling the virtues of undefined behavior - I've never heard much serious criticism of it.
      - anonfordays 2y ago
        [flagged]
      - akira2501 2y ago
        > why it's considered low quality Other software providing the same features produce better results for those users. It's dependency management is fundamentally broken and causes builds to be much slower than they could otherwise be. Lack of namespaces which is a lesson well learned before the first line of Cargo was ever written. I could go on. > evidence of this "wide regard" We are on the internet. If you doubt me you can easily falsify this yourself. Or you could discover something you've been ignorant of up until now. Try "rust cargo sucks" as a search motif. > random weirdos Which may or may not be true, but you believe it, and yet you use your time to comment to us. This is more of a criticism of yourself than of me; however, I do appreciate your attempt to be insulting and dismissive.
        sophacles 2y ago
        Im not attempting to insult you, i didn't know you held such a hypocritical position - sorry pointing out that it is weird for someone working a field that is so dependent on logic to hold such a self-contradictory position insults you. Maybe instead of weird i should use the words unusual and unexpected. My bad. You're right, I'm being dismissive of weasely unbacked claims of "wide regard". It's very clear now that you can't back your claim and I can safely ignore your entire argument as unfounded. Thanks for confirming!
cLe223 2y ago
1. Oxide made an unproven statement ("QEMU is often the subject of bugs affecting its reliability and security.") 2. OP (bonzini) has given specific and valid arguments that that statement is wrong. 3. You're not answering to that specific arguments, but defending Rust and bashing C++ generally without giving any prove. 4. bonzini again provides specific arguments that your generalization is not correct in that context. That despite Firecracker being written in Rust it had a security issue. 5. You still insist without given any solid argument. You just insist that Rust is superior. Not helpful in any discussion. Think about it.
- TimTheTinker 2y ago
  You're right on (1) and (2) - Oxide used weasel words when explaining the decision. My point is that their poor explanation doesn't necessarily mean it was the wrong decision. A bad defense attorney doesn't imply the defendant committed the crime. I'm not bashing C++ beyond saying "any sufficiently large codebase originally written in C or C++ has memory safety bugs". I did not say those bugs are exploitable, just that they're present. I'm also not insisting Rust is superior, except to say that it raises the floor of software quality, because it nearly eliminates a class of memory safety bugs. Do you disagree? Neither of those statements implies C++ sucks or that Rust is awesome. Just 2 important data points (among many others) to consider in whatever context you're writing code in.

akira2501 2y ago

> it raises the floor on software quality. Languages cannot possibly do this.

TimTheTinker 2y ago
I believe TypeScript and Rust are both strong examples of languages that do this (for different reasons and in different ways). It's also possible for a language to raise the ceiling of software quality, and Zig is an excellent example. I'm thinking of "floors" and "ceilings" as the outer bounds of what happens in real, everyday life within particular software ecosystems in terms of software quality. By "quality" I mean all of capabilities, performance, and absence of problems. It takes a team of great engineers (and management willing to take a risk) to benefit from a raised ceiling. TigerBeetle[0] is an example of what happens when you pair a great team, great research, and a high-ceiling language. [0] https://tigerbeetle.com/ https://tigerbeetle.com/
- akira2501 2y ago
  > possible for a language to raise the ceiling of software quality Cargo is widely recognized as low quality. The thesis fails within it's own standard packaging. It's possible for a language to be used by _more people_ and thus raise the quality _in aggregate_ of produced software but the language itself has no bearing on quality in any objective measure. > to benefit from a raised ceiling You're explicitly putting the cart before the horse here. The more reasonable assertion is that it takes good people to get good results regardless of the quality of the tool. Acolytes are uncomfortable saying this because it also destroys the negative case, which is, it would be impossible to write quality software in a previous generation language. > TigerBeetle[0] is an example Of a protocol and a particular implementation of that protocol. It has client libraries in multiple languages. This has no bearing on this point.
  - TimTheTinker 2y ago
    > The more reasonable assertion is that it takes good people to get good results regardless of the quality of the tool. That's totally true, and I never contradicted that. By "ceiling" I mean the limit of what is possible. A great team can do a lot more when they have great tools.
  - sophacles 2y ago
    > Cargo is widely recognized as low quality. Can you point me to both of: * why it's considered low quality * evidence of this "wide regard" Other than random weirdos who think allowing dependencies is a bad practice because you could hurt yourself, while extolling the virtues of undefined behavior - I've never heard much serious criticism of it.
    - anonfordays 2y ago
      [flagged]
    - akira2501 2y ago
      > why it's considered low quality Other software providing the same features produce better results for those users. It's dependency management is fundamentally broken and causes builds to be much slower than they could otherwise be. Lack of namespaces which is a lesson well learned before the first line of Cargo was ever written. I could go on. > evidence of this "wide regard" We are on the internet. If you doubt me you can easily falsify this yourself. Or you could discover something you've been ignorant of up until now. Try "rust cargo sucks" as a search motif. > random weirdos Which may or may not be true, but you believe it, and yet you use your time to comment to us. This is more of a criticism of yourself than of me; however, I do appreciate your attempt to be insulting and dismissive.
      - sophacles 2y ago
        Im not attempting to insult you, i didn't know you held such a hypocritical position - sorry pointing out that it is weird for someone working a field that is so dependent on logic to hold such a self-contradictory position insults you. Maybe instead of weird i should use the words unusual and unexpected. My bad. You're right, I'm being dismissive of weasely unbacked claims of "wide regard". It's very clear now that you can't back your claim and I can safely ignore your entire argument as unfounded. Thanks for confirming!

cLe223 2y ago

1. Oxide made an unproven statement ("QEMU is often the subject of bugs affecting its reliability and security.") 2. OP (bonzini) has given specific and valid arguments that that statement is wrong. 3. You're not answering to that specific arguments, but defending Rust and bashing C++ generally without giving any prove. 4. bonzini again provides specific arguments that your generalization is not correct in that context. That despite Firecracker being written in Rust it had a security issue. 5. You still insist without given any solid argument. You just insist that Rust is superior. Not helpful in any discussion. Think about it.

TimTheTinker 2y ago
You're right on (1) and (2) - Oxide used weasel words when explaining the decision. My point is that their poor explanation doesn't necessarily mean it was the wrong decision. A bad defense attorney doesn't imply the defendant committed the crime. I'm not bashing C++ beyond saying "any sufficiently large codebase originally written in C or C++ has memory safety bugs". I did not say those bugs are exploitable, just that they're present. I'm also not insisting Rust is superior, except to say that it raises the floor of software quality, because it nearly eliminates a class of memory safety bugs. Do you disagree? Neither of those statements implies C++ sucks or that Rust is awesome. Just 2 important data points (among many others) to consider in whatever context you're writing code in.