5 ms·

Yes, let’s introduce a hard dependency on a language which has no specification, only one compiler and supports a pitiful number of architectures. That’s what t

Yes, let’s introduce a hard dependency on a language which has no specification, only one compiler and supports a pitiful number of architectures. That’s what true progress looks like.

scott_w 11mo ago
How has a language specification and multiple viable compilers helped C developers write security-critical code?
- StopDisinfo910 11mo ago
  Considering the number of provers and statistical analysers and given C is the only mainstream language with a formally verified compiler, I would say fairly well thank you. Honestly, I am not even opposed to Rust. It has cool ideas. I do think it should care a lot more about being portable and properly defined and should have done so a lot earlier and I do deeply disagree with the opinion of some core team members that specification is meaningless. C obviously always was a questionable choice for a tool like apt but Rust seems even worse to me. Apt has absolutely no need to be written in a low level language. At least you could argue that C was chosen because it’s portable but I don’t see what Rust has going for it.
  - scott_w 11mo ago
    All those things didn’t stop Heartbleed or numerous other CVEs from happening, though, did it?
  - krzyk 11mo ago
    Doesn't Java have also a formally verified compiler?
hypeatei 11mo ago
Ferrous Systems donated their language specification ("Ferrocene") to the Rust foundation[0] who is working on integrating it but that takes time, obviously. 0: https://rustfoundation.org/media/ferrous-systems-donates-ferrocene-language-specification-to-rust-project/ https://rustfoundation.org/media/ferrous-systems-donates-fer...
- arccy 11mo ago
  Their spec just happens to describe whatever the compiler decided to implement, it's not a source of truth.
  - Mond_ 11mo ago
    And? What did you think it was going to be? An abstract description that completely ignores the existing compiler?
  - dgsii 11mo ago
    I don’t think it’s a fair argument to criticize a spec because it’s derived from an implementation. If anything it shows how the spec can be practically applied.
  - jjmarr 11mo ago
    That's literally what the C++ specification does. The reason for all the UB and implementation defined stuff is because 90s compilers disagreed on sizeof(int).
  - LexiMax 11mo ago
    How do you think that C got specified? Do you think that it was made up from whole cloth in the abstract machine and implemented later? No, it was based on the available implementations of its time. On top of that, languages like Python do not have a specification and yet have multiple implementations.
Spivak 11mo ago
Check the list of supported architectures https://wiki.debian.org/SupportedArchitectures https://wiki.debian.org/SupportedArchitectures, it's pretty short. Official support extends to exactly 5 architectures. So Debian was never going to be your go to for anything not mainstream.
gpm 11mo ago
Flagged for deliberately spreading disinformation under the name StopDisinfo. As this user is aware, rust has a specification https://github.com/rust-lang/fls https://github.com/rust-lang/fls, which they have previously commented on: https://news.ycombinator.com/item?id=44927141 https://news.ycombinator.com/item?id=44927141 (and which I probably wouldn't have remembered if not for the rather remarkable name they are saying false things under). Rust also has multiple compilers (rustc, mrustc, and gccrs) though only one is production ready at this time.
- cwzwarich 11mo ago
  The Rust specification you link is performative and only intended to satisfy requirements of certification processes. No one is actually using it to implement the language, as far as I am aware. There is other work on specifying Rust (e.g. the Unsafe Code Guidelines Working Group), but nothing approaching a real spec for the whole language. Honestly, it is probably impossible at this point; Rust has many layers of implementation-defined hidden complexities.
  - woodruffw 11mo ago
    “There’s a standard, but it’s performative” is a different argument than the top level one. But even if we accept that, it doesn’t seem like a good comparative argument: anybody who has written a nontrivial amount of C or C++ has dealt with compiler-defined behavior or compiler language extensions. These would suggest that the C and C++ standards are “performative” in the same sense, but repeated claims about the virtues of standardization don’t seem compatible with accepting that.
    - csande17 11mo ago
      They have a document that they sometimes describe using the word "specification", but its README clarifies that it's not actually a specification: > The FLS is not intended to be used as the normative specification of the Rust language
      - 11mo ago
cogman10 11mo ago
Because there's so many PIC, MIP, and PS/2 systems out there running debian? The war is over. ARM and x86 won.
- lambdaone 11mo ago
  RISC-V is well on its way to be a challenger to both, with (eventually) full support for Rust.
  - cogman10 11mo ago
    I'll be happy if it does, but I very much have a "I'll believe it when I see it" view of new archs like RISC-V.
woodruffw 11mo ago
I don’t think this is a good argument, given that there are manifestly successful languages that don’t have a formal specification. Python comes to mind. (Plus, architecture quantity isn’t exactly the thing that matters. Quality is what matters, and Rust’s decision to conservatively stabilize on the subset of LLVM backends they can reliably test on seems very reasonable to me.)
15155 11mo ago
gccrs exists?
loeg 11mo ago
The complaint about architecture support is somewhat valid (though: the world largely runs on a small handful of architectures). The other complaints are completely bogus, and repeatedly bringing them up just suggests bad faith.
Denvercoder9 11mo ago
Perl has been a hard dependency of the base system since forever and it doesn't have a specification nor more than one interpreter.
- gmueckl 11mo ago
  The only spec you need meet to get Perl or Python running on a new platform is the C spec. A compiler meeting that spec is enough to port and compile the interpreter for a new platform.
dang 11mo ago
Can you please make your substantive points thoughtfully instead of posting in the flamewar style? We're trying for the one and not the other here: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. (We detached this subthread from https://news.ycombinator.com/item?id=45782109 https://news.ycombinator.com/item?id=45782109.)
Too 11mo ago
Large share of C programs also (accidentally) depend on holes in the specifications, aka undefined behavior. Putting them under the mercy of the compiler to remain consistent.

Yes, let’s introduce a hard dependency on a language which has no specification, only one compiler and supports a pitiful number of architectures. That’s what true progress looks like.

scott_w 11mo ago

How has a language specification and multiple viable compilers helped C developers write security-critical code?

StopDisinfo910 11mo ago
Considering the number of provers and statistical analysers and given C is the only mainstream language with a formally verified compiler, I would say fairly well thank you. Honestly, I am not even opposed to Rust. It has cool ideas. I do think it should care a lot more about being portable and properly defined and should have done so a lot earlier and I do deeply disagree with the opinion of some core team members that specification is meaningless. C obviously always was a questionable choice for a tool like apt but Rust seems even worse to me. Apt has absolutely no need to be written in a low level language. At least you could argue that C was chosen because it’s portable but I don’t see what Rust has going for it.
- scott_w 11mo ago
  All those things didn’t stop Heartbleed or numerous other CVEs from happening, though, did it?
- krzyk 11mo ago
  Doesn't Java have also a formally verified compiler?

hypeatei 11mo ago

Ferrous Systems donated their language specification ("Ferrocene") to the Rust foundation[0] who is working on integrating it but that takes time, obviously. 0: https://rustfoundation.org/media/ferrous-systems-donates-ferrocene-language-specification-to-rust-project/ https://rustfoundation.org/media/ferrous-systems-donates-fer...

arccy 11mo ago
Their spec just happens to describe whatever the compiler decided to implement, it's not a source of truth.
- Mond_ 11mo ago
  And? What did you think it was going to be? An abstract description that completely ignores the existing compiler?
- dgsii 11mo ago
  I don’t think it’s a fair argument to criticize a spec because it’s derived from an implementation. If anything it shows how the spec can be practically applied.
- jjmarr 11mo ago
  That's literally what the C++ specification does. The reason for all the UB and implementation defined stuff is because 90s compilers disagreed on sizeof(int).
- LexiMax 11mo ago
  How do you think that C got specified? Do you think that it was made up from whole cloth in the abstract machine and implemented later? No, it was based on the available implementations of its time. On top of that, languages like Python do not have a specification and yet have multiple implementations.

Spivak 11mo ago

Check the list of supported architectures https://wiki.debian.org/SupportedArchitectures https://wiki.debian.org/SupportedArchitectures, it's pretty short. Official support extends to exactly 5 architectures. So Debian was never going to be your go to for anything not mainstream.

gpm 11mo ago

Flagged for deliberately spreading disinformation under the name StopDisinfo. As this user is aware, rust has a specification https://github.com/rust-lang/fls https://github.com/rust-lang/fls, which they have previously commented on: https://news.ycombinator.com/item?id=44927141 https://news.ycombinator.com/item?id=44927141 (and which I probably wouldn't have remembered if not for the rather remarkable name they are saying false things under). Rust also has multiple compilers (rustc, mrustc, and gccrs) though only one is production ready at this time.

cwzwarich 11mo ago
The Rust specification you link is performative and only intended to satisfy requirements of certification processes. No one is actually using it to implement the language, as far as I am aware. There is other work on specifying Rust (e.g. the Unsafe Code Guidelines Working Group), but nothing approaching a real spec for the whole language. Honestly, it is probably impossible at this point; Rust has many layers of implementation-defined hidden complexities.
- woodruffw 11mo ago
  “There’s a standard, but it’s performative” is a different argument than the top level one. But even if we accept that, it doesn’t seem like a good comparative argument: anybody who has written a nontrivial amount of C or C++ has dealt with compiler-defined behavior or compiler language extensions. These would suggest that the C and C++ standards are “performative” in the same sense, but repeated claims about the virtues of standardization don’t seem compatible with accepting that.
  - csande17 11mo ago
    They have a document that they sometimes describe using the word "specification", but its README clarifies that it's not actually a specification: > The FLS is not intended to be used as the normative specification of the Rust language
    - 11mo ago

cogman10 11mo ago

Because there's so many PIC, MIP, and PS/2 systems out there running debian? The war is over. ARM and x86 won.

lambdaone 11mo ago
RISC-V is well on its way to be a challenger to both, with (eventually) full support for Rust.
- cogman10 11mo ago
  I'll be happy if it does, but I very much have a "I'll believe it when I see it" view of new archs like RISC-V.

woodruffw 11mo ago

I don’t think this is a good argument, given that there are manifestly successful languages that don’t have a formal specification. Python comes to mind. (Plus, architecture quantity isn’t exactly the thing that matters. Quality is what matters, and Rust’s decision to conservatively stabilize on the subset of LLVM backends they can reliably test on seems very reasonable to me.)

15155 11mo ago

gccrs exists?

loeg 11mo ago

The complaint about architecture support is somewhat valid (though: the world largely runs on a small handful of architectures). The other complaints are completely bogus, and repeatedly bringing them up just suggests bad faith.

Denvercoder9 11mo ago

Perl has been a hard dependency of the base system since forever and it doesn't have a specification nor more than one interpreter.

gmueckl 11mo ago
The only spec you need meet to get Perl or Python running on a new platform is the C spec. A compiler meeting that spec is enough to port and compile the interpreter for a new platform.

dang 11mo ago

Can you please make your substantive points thoughtfully instead of posting in the flamewar style? We're trying for the one and not the other here: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. (We detached this subthread from https://news.ycombinator.com/item?id=45782109 https://news.ycombinator.com/item?id=45782109.)

Too 11mo ago

Large share of C programs also (accidentally) depend on holes in the specifications, aka undefined behavior. Putting them under the mercy of the compiler to remain consistent.