2 ms·

Sure but nobody is actually writing foundational software (as we are now calling it) in Lisp, Java or Ada (and it also has no good answer for use-after-free whi

Sure but nobody is actually writing foundational software (as we are now calling it) in Lisp, Java or Ada (and it also has no good answer for use-after-free which is a huge class of vulnerabilities). This is the first point in history where it's actually feasible in real non-research life to write an entire system in only memory safe languages. (And no, the existence of `unsafe` doesn't invalidate this point.)

pjmlp 1y ago
I see plenty of foundational software in the biggest mobile OS, IoT devices and cloud computing infrastructure. Ada only has use-after-free if unchecked deallocation is used, since we are way beyond Ada83, alternatives do exist in Ada 2022. If anything we will only get more foundational software in safer languages, when the generation that only accepts C and C++ for specific domains is no longer among us. Unfortunately to me as well, it isn't something I will be able to witness.
- IshKebab 1y ago
  > Ada only has use-after-free if unchecked deallocation is used You mean if you just never deallocate? Or is there a third option? Genuine question; I don't follow Ada closely. > If anything we will only get more foundational software in safer languages, when the generation that only accepts C and C++ for specific domains is no longer among us. I'm more optimistic - the Rust in Linux people are making progress and that's probably the thickest den of naysayers. Uutils is actually being used in Ubuntu (and sudo-rs I think?). It'll probably take a long time until Rust outweighs C but I think we're talking 10-20 years not 30-40.
  - pjmlp 1y ago
    In practice, Unchecked_Deallocation should be used as much as unsafe in Rust. Ada provides a series of features towards that goal. First one, already present in Ada 83, is that stack allocation is dynamic, a bit like C99 VLAs, with the differenc that it is bounds checked and and exception is thrown if there is not enough space, instead of corrupting the stack. Also Ada pointers (access types), have some type constraints, so already with that one can make some kind of arena like storage that doesn't depend on using pointers all over the place. Ada 95 introduced controlled types, which is basically RAII in Ada, providing yet another way not to use Unchecked_Deallocation directly on "userspace" code. Ada 2005 introduced bounded and unbounded container types, further extended and improved in later versions, which allow to write many algorithms and data structures that build upon them, without having to go into low level memory allocation approaches. With Ada 2012 formal proofs, coupled with SPARK 2014 tooling, you can additionally ensure specific conditions are met before doing whatever with specific resources, including ownership.

pjmlp 1y ago

I see plenty of foundational software in the biggest mobile OS, IoT devices and cloud computing infrastructure. Ada only has use-after-free if unchecked deallocation is used, since we are way beyond Ada83, alternatives do exist in Ada 2022. If anything we will only get more foundational software in safer languages, when the generation that only accepts C and C++ for specific domains is no longer among us. Unfortunately to me as well, it isn't something I will be able to witness.

IshKebab 1y ago
> Ada only has use-after-free if unchecked deallocation is used You mean if you just never deallocate? Or is there a third option? Genuine question; I don't follow Ada closely. > If anything we will only get more foundational software in safer languages, when the generation that only accepts C and C++ for specific domains is no longer among us. I'm more optimistic - the Rust in Linux people are making progress and that's probably the thickest den of naysayers. Uutils is actually being used in Ubuntu (and sudo-rs I think?). It'll probably take a long time until Rust outweighs C but I think we're talking 10-20 years not 30-40.
- pjmlp 1y ago
  In practice, Unchecked_Deallocation should be used as much as unsafe in Rust. Ada provides a series of features towards that goal. First one, already present in Ada 83, is that stack allocation is dynamic, a bit like C99 VLAs, with the differenc that it is bounds checked and and exception is thrown if there is not enough space, instead of corrupting the stack. Also Ada pointers (access types), have some type constraints, so already with that one can make some kind of arena like storage that doesn't depend on using pointers all over the place. Ada 95 introduced controlled types, which is basically RAII in Ada, providing yet another way not to use Unchecked_Deallocation directly on "userspace" code. Ada 2005 introduced bounded and unbounded container types, further extended and improved in later versions, which allow to write many algorithms and data structures that build upon them, without having to go into low level memory allocation approaches. With Ada 2012 formal proofs, coupled with SPARK 2014 tooling, you can additionally ensure specific conditions are met before doing whatever with specific resources, including ownership.