11 ms·
US government wants devs to stop using C and C++
- rini17 2y agoLinus does not use standard C either. Linux kernel depends on -fwrapv switch (reduced UB on signed ints). Also in discussion about Rust mentioned the kernel has lots of infrastructure that almost makes C into different language.
- ikekkdcjkfke 2y agoCouldn't one pre process all of these unsafe c things with additional overflow checks and just crash. Let the cpu branch thingy do the optimizations
- kstrauser 2y agoSo all we’d have to do is convince C programmers to use a slightly slower libsafec because it’s demonstrably true that no one can use the current language safely? Seems easy enough! But really, no, one could, but one won’t. It’d be easier to convince everyone to switch to Rust than to a safer C.
- uecker 2y agoSafety in C improves dramatically with good tooling and coding practice and you can slowly move to safer C without much pain. People who really do not care will also create problems with Rust.
- AlotOfReading 2y agoWe've discussed this before. The issue is the same that it's always been. A single mistake anywhere in your codebase means that all language invariants are no longer upheld. No tooling can statically guarantee defined behavior, only catch some of the easier cases. I work in a codebase where we do all of that high powered static analysis and I still regularly find issues with simple tools like ubsan (which isn't remotely exhaustive). Any instance of undefined behavior in safe rust is a language or compiler bug. The only things you really need to check are unsafe blocks, which are rare enough to individually review line by line on a regular basis.
- uecker 2y agoI see Rust code with quite a lof of unsafe and sometimes it has bugs, sometimes triggered from preconditions broken outside of the unsafe block. So no, I think it is an oversimplification to pretend that "only a couple of lines need to be reviewed". And then there other safety issues than memory safety. But I think a safe C that has similar guarantees as Rust is quite possible and we can gradually move there.
- kstrauser 2y agoI genuinely don’t think we can move there at all. There are significant cultural issues: as soon as a safe version with bounds checking is 2% slower, a significant chunk of programmers will claim they can’t use it. There’s also the glacial pace of tooling changes, so even if a safer C existed today, it’d be a couple decades before it was commonly used. But frankly, if you’re going through all that trouble, it’s probably worth considering a newer language that fixes those things today. I mentioned Rust as one example, not the end-all solution to all problems. Nim also plays on the same space and it’s quite nice. The broader point is that I believe it’d be easier to start writing new code in a different language that can easily call existing C code.
- uecker 2y agoI do not think newer languages are the solution for two reasons: First, all those new languages also have various downsides, and trade-offs, which may make them a less than ideal choice for many applications. Second, there are an incredible amount of existing C code. We will not get rid of C in the next at least 50 years even if we wanted to (not that I want to). Incrementally improving that code is far more useful than adding other languages into the mix.
- nuancebydefault 2y agoYou can always wrap C into a higher level language that makes it safe, but why the hassle? That new language might as well be Rust,which is built up from the bottem with safety in mind.
- mdhb 2y agoAnd yet we can also just look at how memory vulnerabilities have impacted the Linux kernel over the years in order to assess how much they have helped to reduce the risk that memory unsafe languages bring.
- kstrauser 2y agoYou're right, and it's not just memory safety in the use-after-free sense. I just had to audit some out-of-bounds read CVEs, like https://nvd.nist.gov/vuln/detail/CVE-2024-46723 https://nvd.nist.gov/vuln/detail/CVE-2024-46723. Rust really makes you work hard to read past the end of an array.
- uecker 2y agoRust makes a lot of things hard. Update: From your CVE "Clear warning that read ucode[] may out-of-bounds." So it seems this was catched by tooling.
- jjgreen 2y agoYou mind your own projects, I code in what I like.
- 2OEH8eoCRo0 2y agoPut your money where your mouth is govt! Make memory safety a contract requirement.
- AnimalMuppet 2y agoThey won't. If they did, things would become more expensive, and they would take longer. So they won't.
- johnnyanmac 2y agoWell this is all just pretty platitudes then. You get what you pay for. Shame because I'm not opposed to a shift to Rust tools for safety's sake.
- kvemkon 2y agoDiscussed recently: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk (01.11.2024) https://news.ycombinator.com/item?id=42013379 https://news.ycombinator.com/item?id=42013379
- hed 2y agoDidn’t the Department of Defense try to mandate Ada in the 1980s? That went nowhere.
- firesteelrain 2y agoAda 95 is still around. I know personally and have used it. It is being slowly ripped out of a major system but it persists. AdaCore and GNAT help a lot too.
- pjmlp 2y agoIt went to 7 Ada vendors still in business in 2024, in an age where many folks refuse to pay for their work tools. Folks that play the Ada card don't get then issues regarding compiler prices for Ada, versus C and C++ free UNIX compilers (it was an additional license on UNIX SDKs), the hardware requirements, the salaries for devs with Ada skills, and yet those 7 companies manage to stay in business.
- firesteelrain 2y agoIf the USG wants this then they need to start inserting it into Statements of Work then companies bidding on this type of work can assess impacts and provide a business case. It will be slow but start there. The same way Risk Management Framework works, DoD 8570, etc
- deleted 2y ago[deleted]
- Jtsummers 2y agoThey will. This language is already creeping into contract discussions, though nothing I've been party to has actually required dropping C or C++. It's making it into RFIs already. It'll be in actual requirements in a couple more years, probably. And then it'll be forgotten like Ada before it.
- martinky24 2y agoThere are lots of big government contractors (Raytheon, etc) still writing and maintaining a lot of Ada.
- deleted 2y ago[deleted]
- firesteelrain 2y agoAgree. Those companies was what I was referring to
- firesteelrain 2y agoRFIs are great but if it’s not in the SOW then it’s a desirement and the contractor is correct to reject. RFI all they want - put it in the SOW and turn it into a requirement.
- pjmlp 2y agoC and C++ folks like to play Ada card, missing the fact that it didn't took off due to the price of compilers and the hardware to run them, coupled by cheaper C and C++ developer salaries. They miss the fact we aren't in 1980's any longer, Infosec and pentesting is standard procedure before deployment in many industries, insurances and companies now have a ball in the game regarding cibersecurity and nation state sponsored attacks.
- galleywest200 2y ago> If only it were that easy to snap your fingers and magically transform your code base from C to Rust. Spoiler alert: It's not. This misses the point. The point is to start moving in that direction, not instantaneously.
- up2isomorphism 2y agoRust should just build their own super safe OS, instead of nagging existing projects to adopt their practices. If they can successfully build an another successful OS it is much more convincing.
- LeFantome 2y agoWhat makes an OS “successful”? Does that have anything at all to do with the point they are making? Do you just mean, successfully make an OS? Because there are multiple examples of Rust based operating systems that are complete or nearly so. https://www.redox-os.org/ https://www.redox-os.org/ Or by “successful”, do we mean that it is popular? Because popularity has rarely correlated with technical superiority in the past ( or present ). Windows is much more popular than Linux. Linux surged to popularity when FreeBSD was more complete and technically superior. Plan 9 has entered the chat. Popularity depends on totally different skills and circumstances than technical excellence. Memory safety, performance, and security do not necessarily drive popularity. What do we mean by success?
- ducktective 2y ago> What do we mean by success? They should write an OS that is "so good" that people start talking about it as much as the options we have now, then people actually start using it on their servers (replacing GNU/Linux), then on their desktops. So good that companies like Google and Apple would consider making their next OSs or userland utilities in Rust. It already happened for some programs like Alacritty, ripgrep but failed to do so in some other domains like user-space window managers. The common argument against it is complexity and learning curve (compared to C). Perhaps I'm not the one who should voice his opinion on this but anyway, I don't like _two_ languages in Linux kernel especially one that increases compile time and imposes heavy storage requirement on the development machine. If they want to add it, they should consider migrating everything to it IMO.
- iknowstuff 2y agoexposing billions of people to security vulnerabilities by preventing Rust from being used in Rust due to compile times or storage requirements of developers is morally questionable
- npalli 2y ago1991 Edition https://www.gao.gov/products/imtec-91-70br https://www.gao.gov/products/imtec-91-70br Pursuant to a congressional request, GAO obtained information on the Department of Defense's (DOD) implementation of legislation which mandated using the Ada programming language for all software development, where cost-effective.
- pjmlp 2y agoFolks that play the Ada card miss why Ada didn't took off in 1991's hardware.
- secondcoming 2y agoWhat's really needed is an official Engineering qualification for programmers, like you leaglly have to have if you're an Electrician or Gas Engineer, etc. Liability Insurance in case of damaging bugs. Literally anyone can call themselves a Software Engineer, which one the one hand is great because it's accessible, but also a curse in terms of making it a respected profession.
- contingencies 2y agoNo. This is often stated, but I believe provable systems make far more sense than provable people. Exclusionary qualifications and gatekeeping are an anachronism that needs to die. It's a positive thing that computing has lead the way in this area. Other facets of engineering need to do the same.
- mrkeen 2y agoIt's impossible to even aim for provable systems when the dominant paradigm is moving fast.
- secondcoming 2y agoWould you let someone - whose only qualifications is watching YT videos and tinkering around their own home - wire up your house and install your gas appliances? Would your insurer accept that?
- poincaredisk 2y agoThat's equivalent to asking if I would let a hobbyist programmer who just learned python to write his first computer game design and implement my production system. A better comparison would be "would I let someone who self-learned wiring up houses, and then spent five years working under an expert, before finally branching on his own, wire up my house". And the answer is yes.
- kstrauser 2y agoIf you design a bridge that collapses in a way that could be anticipated, you screwed up. Software can fail in ways no one's thought of yet, as evidenced by us still finding new classes of bugs. And even when you write perfect software, it's impossible to know that it's going to evaluate correctly when built with an arbitrary compiler on an arbitrary OS running on an arbitrary hardware platform. Something perfectly fine on Clang/macOS/ARM might be busted on GCC/Linux/x86. Engineers have to be responsible for their work. If you held software engineers to that same legal standard, the occupation would be sued out of existence within a year, even for people who are doing everything possible to do it right.
- bubaumba 2y agoSounds idiotic if you ask me.