4 ms·

I’m curious how this applies to Mac vs Windows, where most newer Mac code is written in memory safe swift, while Windows still uses primarily uses C or C++.

akyuu 2y ago
Apple is still adding large amounts of new Objective-C code in each new macOS version [0]. I haven't found any language usage numbers for recent versions of Windows, but Microsoft is using Rust for both new development and rewriting old features [1] [2]. [0] Refer to section "Evolution of the programming languages" https://blog.timac.org/2023/1128-state-of-appkit-catalyst-swift-swiftui-mac/ https://blog.timac.org/2023/1128-state-of-appkit-catalyst-sw... [1] https://www.theregister.com/2023/04/27/microsoft_windows_rust/ https://www.theregister.com/2023/04/27/microsoft_windows_rus... [2] https://www.theregister.com/2024/01/31/microsoft_seeks_rust_developers/ https://www.theregister.com/2024/01/31/microsoft_seeks_rust_...
- TazeTSchnitzel 2y ago
  It should be noted that Objective-C code is presumably a lot less prone to memory safety issues than C code on average, especially since Apple introduced Automatic Reference Counting (ARC). For example: • Use-after-frees are avoided by ARC • Null pointer dereferences are usually safe (sending a message to nil returns nil) • Objective-C has a great standard library (Foundation) with safe collections among many other things; most of C's dangerous parts are easily avoided in idiomatic Objective-C code that isn't performance-critical But a good part of Apple's Objective-C code is probably there for implementing the underlying runtime, and that's difficult to get right.
  - saagarjha 2y ago
    Most of Apple's Objective-C code is in the application layer just like yours is
- daft_pink 2y ago
  I found the evolution of programming languages article you sourced very interesting. Just to summarize the article, it shows that writing completely new code in memory safe language, while maintaining non-memory safe code, results in a steep reduction in memory safe errors overtime even though it results in an overall increase in unsafe code. It says that most memory safe vulnerabilities come from completely new code not maintained code and thus argues you can get the most of the benefits of memory safe code without rewriting your entire code base, which I think is the main takeaway from the article. I’m not sure that’s totally happening in MacOS from reading your article, but it kind of is, so I think my hypothesis is correct that MacOS will likely have less vulnerabilities as it transitions many newer projects to swift although its important to note that important vulnerable projects such as webkit are still written in C++.
munificent 2y ago
> while Windows still uses primarily uses C or C++. Do you have data for that? My impression is that a large fraction of Windows development is C# these days. Back when I was at EA, nearly fifteen years ago, we were already leaning very heavily towards C# for internal tools.
- tsujamin 2y ago
  Linking to my thread from yesterday, there’s definitely memory safe systems programming happening over there: https://news.ycombinator.com/item?id=41642788 https://news.ycombinator.com/item?id=41642788
- pjmlp 2y ago
  WinDev culture is largely C++ and they aren't in any rush to change that, other than some incremental use of Rust. WinRT is basically COM and C++, nowadays they focus on C# as consumer language, mostly because after killing C++/CX, they never improved the C++/WinRT developer experience since 2016, and only Windows teams use it, while the few folks that still believe WinUI has any future rather reach out for C#. If you want to see big chuncks of C# adoption you have to look into business units under Azure org chart.

akyuu 2y ago

Apple is still adding large amounts of new Objective-C code in each new macOS version [0]. I haven't found any language usage numbers for recent versions of Windows, but Microsoft is using Rust for both new development and rewriting old features [1] [2]. [0] Refer to section "Evolution of the programming languages" https://blog.timac.org/2023/1128-state-of-appkit-catalyst-swift-swiftui-mac/ https://blog.timac.org/2023/1128-state-of-appkit-catalyst-sw... [1] https://www.theregister.com/2023/04/27/microsoft_windows_rust/ https://www.theregister.com/2023/04/27/microsoft_windows_rus... [2] https://www.theregister.com/2024/01/31/microsoft_seeks_rust_developers/ https://www.theregister.com/2024/01/31/microsoft_seeks_rust_...

TazeTSchnitzel 2y ago
It should be noted that Objective-C code is presumably a lot less prone to memory safety issues than C code on average, especially since Apple introduced Automatic Reference Counting (ARC). For example: • Use-after-frees are avoided by ARC • Null pointer dereferences are usually safe (sending a message to nil returns nil) • Objective-C has a great standard library (Foundation) with safe collections among many other things; most of C's dangerous parts are easily avoided in idiomatic Objective-C code that isn't performance-critical But a good part of Apple's Objective-C code is probably there for implementing the underlying runtime, and that's difficult to get right.
- saagarjha 2y ago
  Most of Apple's Objective-C code is in the application layer just like yours is
daft_pink 2y ago
I found the evolution of programming languages article you sourced very interesting. Just to summarize the article, it shows that writing completely new code in memory safe language, while maintaining non-memory safe code, results in a steep reduction in memory safe errors overtime even though it results in an overall increase in unsafe code. It says that most memory safe vulnerabilities come from completely new code not maintained code and thus argues you can get the most of the benefits of memory safe code without rewriting your entire code base, which I think is the main takeaway from the article. I’m not sure that’s totally happening in MacOS from reading your article, but it kind of is, so I think my hypothesis is correct that MacOS will likely have less vulnerabilities as it transitions many newer projects to swift although its important to note that important vulnerable projects such as webkit are still written in C++.

munificent 2y ago

> while Windows still uses primarily uses C or C++. Do you have data for that? My impression is that a large fraction of Windows development is C# these days. Back when I was at EA, nearly fifteen years ago, we were already leaning very heavily towards C# for internal tools.

tsujamin 2y ago
Linking to my thread from yesterday, there’s definitely memory safe systems programming happening over there: https://news.ycombinator.com/item?id=41642788 https://news.ycombinator.com/item?id=41642788
pjmlp 2y ago
WinDev culture is largely C++ and they aren't in any rush to change that, other than some incremental use of Rust. WinRT is basically COM and C++, nowadays they focus on C# as consumer language, mostly because after killing C++/CX, they never improved the C++/WinRT developer experience since 2016, and only Windows teams use it, while the few folks that still believe WinUI has any future rather reach out for C#. If you want to see big chuncks of C# adoption you have to look into business units under Azure org chart.