5 ms·

Languages with unsafe don't just change where the security boundary lies. It shrinks the size of the area that the boundary surrounds. C++ has artificially lim

by zaphar 1y ago

Languages with unsafe don't just change where the security boundary lies. It shrinks the size of the area that the boundary surrounds. C++ has artificially limited how much it can improve the memory safety picture because of their quite valid dedication to backwards compatibility. This is a totally valid choice on their part but it does mean that C++ is largely out of the running for the kinds of table stakes memory safety stuff the article talks about. There are dozens of memory safe languages that already exist: Java, Go, Python, C#, Rust, ... And a whole host of other ones I'm not going to bother listing here.

torstenvl 1y ago
[flagged]
- School-Cotton 1y ago
  What does “proprietary” mean to you?
  - torstenvl 1y ago
    It doesn't mean anything "to me." Its meaning is clear and objective and applies to every language listed above.
    - School-Cotton 1y ago
      Okay, please explain in what sense Python or Rust is proprietary.
      - torstenvl 1y ago
        In all senses. They are both 100% proprietary. There is no sense in which either language is anything other than proprietary. It is literally illegal for me to start marketing The TorstenVL Rust Compiler. Because the language is proprietary.
        ben0x539 1y ago
        All of these have implementations available under free software licenses so they are clearly and objectively not proprietary. Trademarks are annoying but I can hardly imagine they're what anyone is worried about when picking a language in this context, they're not what's going to cause a language to disappear.
        torstenvl 1y ago
        That's completely nonsensical.
        zahlman 1y ago
        No; that's what the word "proprietary" means as applied to software.
        anonymars 1y ago
        Care to elaborate?
        deleted 1y ago
        [deleted]
        SpaceNugget 1y ago
        A trademark on the word "Rust" has nothing to do with whether the language itself is proprietary. Clearly and Objectively. What you can call something and whether you can legally make the thing or have a permissive license to an existing implementation are two completely unrelated things. For example, you also can't make a C compiler and name it the "microsoft C compiler" due to your lack of trademark right. Does that mean C is also proprietary? See also: The most famous open source project is trademarked https://www.linuxfoundation.org/legal/trademark-usage https://www.linuxfoundation.org/legal/trademark-usage If you still aren't convinced, you are definitely using a different definition of the word proprietary than everyone else.
        zahlman 1y ago
        Wikipedia tells me: > Proprietary software is software that grants its creator, publisher, or other rightsholder or rightsholder partner a legal monopoly by modern copyright and intellectual property law to exclude the recipient from freely sharing the software or modifying it, and—in some cases, as is the case with some patent-encumbered and EULA-bound software—from making use of the software on their own, thereby restricting their freedoms.[1] > Proprietary software is a subset of non-free software, a term defined in contrast to free and open-source software; non-commercial licenses such as CC BY-NC are not deemed proprietary, but are non-free. Proprietary software may either be closed-source software or source-available software.[1][2] The Python development team, via the LICENSE file in the GitHub repository, tells me > All Python releases are Open Source (see https://opensource.org https://opensource.org for the Open Source Definition). Historically, most, but not all, Python releases have also been GPL-compatible; the table below summarizes the various releases. This license is also described on Wikipedia at https://en.wikipedia.org/wiki/Python_License https://en.wikipedia.org/wiki/Python_License . Similarly, the reference Rust implementation (https://github.com/rust-lang/rust https://github.com/rust-lang/rust) is licensed under Apache 2.0 and MIT licenses. In what sense is FOSS software a kind of non-FOSS software?
      - eimrine 1y ago
        Rust implementations are owned by some megacorps, exactly as Java. Compare with C which is not owned by anyone.
        deleted 1y ago
        [deleted]
        School-Cotton 1y ago
        That’s not true. The only rust implementation with a significant number of users is rustc which is Apache licensed and owned by the Rust foundation.
    - SpaceNugget 1y ago
      [flagged]
      - jazzyjackson 1y ago
        I just checked merriam webster, "something that is used, produced, or marketed under exclusive legal right of the inventor or maker" exclusive legal right = not permissively licensed. it's really not a matter of jargon. EDIT: nvm parent is confused and thinks trademarks are the same as nonfree.
- johnfernow 1y ago
  The Java language specification is open and there are multiple implementations. OpenJDK is the official open-source reference implementation, and many of the alternative implementations pull from upstream, but OpenJ9 is a different JVM implementation (though does currently use OpenJDK's class libraries to form a complete JDK.) Before Microsoft opened-up C#, Mono was a completely independent alternative implementation. Python has CPython (reference open source implementation), but also PyPy, MicroPython and several others.
  - torstenvl 1y ago
    I'm not sure what you mean when you say the Java spec is open, but Oracle certainly took the position—and the Supreme Court confirmed—that they own copyright in the APIs. Has Oracle dedicated those to the public domain in the meantime? Or at least licensed them extremely permissively? More importantly, is there a public body that owns the spec?
    - Jtsummers 1y ago
      For C# there is the ECMA specification for it https://ecma-international.org/publications-and-standards/standards/ecma-334/ https://ecma-international.org/publications-and-standards/st... But who cares if there's a public body who owns the specification? The Supreme Court ruled Google's use of the copyrighted APIs fell within fair use. That gives, within the US (other countries will have other legal circumstances) a basis for anyone to copy pretty much any language so long as they steer clear of the actual copyrighted source code (don't copy MS's C# source code, for instance) and trademark violations.
      - torstenvl 1y ago
        [flagged]
        deleted 1y ago
        [deleted]
        1y ago
- zahlman 1y ago
  > Most of them have a single implementation. None of them have a single implementation. It only took a few minutes to find all the following: * https://en.wikipedia.org/wiki/Free_Java_implementations https://en.wikipedia.org/wiki/Free_Java_implementations * Go has gofrontend and GopherJS aside from the reference implementation * Python has a whole slew of alternate implementations listed on the main Python web site: https://www.python.org/download/alternatives/ https://www.python.org/download/alternatives/ * C# has Mono, which actually implements the entire .NET framework * Rust has Rust-GCC and gccrs

by zaphar 1y ago

torstenvl 1y ago

[flagged]

School-Cotton 1y ago
What does “proprietary” mean to you?
- torstenvl 1y ago
  It doesn't mean anything "to me." Its meaning is clear and objective and applies to every language listed above.
  - School-Cotton 1y ago
    Okay, please explain in what sense Python or Rust is proprietary.
    - torstenvl 1y ago
      In all senses. They are both 100% proprietary. There is no sense in which either language is anything other than proprietary. It is literally illegal for me to start marketing The TorstenVL Rust Compiler. Because the language is proprietary.
      - ben0x539 1y ago
        All of these have implementations available under free software licenses so they are clearly and objectively not proprietary. Trademarks are annoying but I can hardly imagine they're what anyone is worried about when picking a language in this context, they're not what's going to cause a language to disappear.
        torstenvl 1y ago
        That's completely nonsensical.
        zahlman 1y ago
        No; that's what the word "proprietary" means as applied to software.
        anonymars 1y ago
        Care to elaborate?
      - deleted 1y ago
        [deleted]
      - SpaceNugget 1y ago
        A trademark on the word "Rust" has nothing to do with whether the language itself is proprietary. Clearly and Objectively. What you can call something and whether you can legally make the thing or have a permissive license to an existing implementation are two completely unrelated things. For example, you also can't make a C compiler and name it the "microsoft C compiler" due to your lack of trademark right. Does that mean C is also proprietary? See also: The most famous open source project is trademarked https://www.linuxfoundation.org/legal/trademark-usage https://www.linuxfoundation.org/legal/trademark-usage If you still aren't convinced, you are definitely using a different definition of the word proprietary than everyone else.
      - zahlman 1y ago
        Wikipedia tells me: > Proprietary software is software that grants its creator, publisher, or other rightsholder or rightsholder partner a legal monopoly by modern copyright and intellectual property law to exclude the recipient from freely sharing the software or modifying it, and—in some cases, as is the case with some patent-encumbered and EULA-bound software—from making use of the software on their own, thereby restricting their freedoms.[1] > Proprietary software is a subset of non-free software, a term defined in contrast to free and open-source software; non-commercial licenses such as CC BY-NC are not deemed proprietary, but are non-free. Proprietary software may either be closed-source software or source-available software.[1][2] The Python development team, via the LICENSE file in the GitHub repository, tells me > All Python releases are Open Source (see https://opensource.org https://opensource.org for the Open Source Definition). Historically, most, but not all, Python releases have also been GPL-compatible; the table below summarizes the various releases. This license is also described on Wikipedia at https://en.wikipedia.org/wiki/Python_License https://en.wikipedia.org/wiki/Python_License . Similarly, the reference Rust implementation (https://github.com/rust-lang/rust https://github.com/rust-lang/rust) is licensed under Apache 2.0 and MIT licenses. In what sense is FOSS software a kind of non-FOSS software?
    - eimrine 1y ago
      Rust implementations are owned by some megacorps, exactly as Java. Compare with C which is not owned by anyone.
      - deleted 1y ago
        [deleted]
      - School-Cotton 1y ago
        That’s not true. The only rust implementation with a significant number of users is rustc which is Apache licensed and owned by the Rust foundation.
  - SpaceNugget 1y ago
    [flagged]
    - jazzyjackson 1y ago
      I just checked merriam webster, "something that is used, produced, or marketed under exclusive legal right of the inventor or maker" exclusive legal right = not permissively licensed. it's really not a matter of jargon. EDIT: nvm parent is confused and thinks trademarks are the same as nonfree.
johnfernow 1y ago
The Java language specification is open and there are multiple implementations. OpenJDK is the official open-source reference implementation, and many of the alternative implementations pull from upstream, but OpenJ9 is a different JVM implementation (though does currently use OpenJDK's class libraries to form a complete JDK.) Before Microsoft opened-up C#, Mono was a completely independent alternative implementation. Python has CPython (reference open source implementation), but also PyPy, MicroPython and several others.
- torstenvl 1y ago
  I'm not sure what you mean when you say the Java spec is open, but Oracle certainly took the position—and the Supreme Court confirmed—that they own copyright in the APIs. Has Oracle dedicated those to the public domain in the meantime? Or at least licensed them extremely permissively? More importantly, is there a public body that owns the spec?
  - Jtsummers 1y ago
    For C# there is the ECMA specification for it https://ecma-international.org/publications-and-standards/standards/ecma-334/ https://ecma-international.org/publications-and-standards/st... But who cares if there's a public body who owns the specification? The Supreme Court ruled Google's use of the copyrighted APIs fell within fair use. That gives, within the US (other countries will have other legal circumstances) a basis for anyone to copy pretty much any language so long as they steer clear of the actual copyrighted source code (don't copy MS's C# source code, for instance) and trademark violations.
    - torstenvl 1y ago
      [flagged]
      - deleted 1y ago
        [deleted]
      - 1y ago
zahlman 1y ago
> Most of them have a single implementation. None of them have a single implementation. It only took a few minutes to find all the following: * https://en.wikipedia.org/wiki/Free_Java_implementations https://en.wikipedia.org/wiki/Free_Java_implementations * Go has gofrontend and GopherJS aside from the reference implementation * Python has a whole slew of alternate implementations listed on the main Python web site: https://www.python.org/download/alternatives/ https://www.python.org/download/alternatives/ * C# has Mono, which actually implements the entire .NET framework * Rust has Rust-GCC and gccrs