4 ms·

It seems to me that memory safety might be the difference between the software engineering and Software Engineering. As in, an actual Engineering discipline. H

It seems to me that memory safety might be the difference between the software engineering and Software Engineering. As in, an actual Engineering discipline. However, I should probably pipe down, as I would not call myself either one.

himata4113 3mo ago
There are too many opensource projects that show that even with good engineering discipline humans are flawed creatures. Memory safety is just little thing that makes sure that when you write code at 4am that it will not leak memory via trivial mistakes such as forgetting to free something, freeing something twice or passing a freed pointer. I believe AI agents shine here the most because the they do not get tired and are getting pretty damn predictable.
- deleted 3mo ago
  [deleted]
- inigyou 3mo ago
  How many bugs in qmail though?
  - himata4113 3mo ago
    It had one bad cve it seems, but that's exactly what I mean. It only takes one mistake, of course you can learn and never make those mistakes again, however, that is an unrealistic expectation in software that receives hundreds of feature updates a year especially when it comes to core applications as basic as communication when it wants to support image previews, reels and whatnot.
    - Brian_K_White 3mo ago
      There will always be one, so "it only takes one" is meaningless and invalid. That leaves less is better than more, and any form of less is as good as any other form of less.
      - deleted 3mo ago
        [deleted]
      - inigyou 3mo ago
        Some Rust programs also had RCE CVEs.
        Ygg2 3mo ago
        Some is doing heavy misrepresentation. Latest batch of LLM's Linux had 423 vulnerabilities. Out of which 10 were Rust*. Would you prefer more or less CVEs? But it's like seat belt analogy. It's a helper not a panacea. * Granted Rust isn't in the entire kernel yet. D
        inigyou 3mo ago
        That sounds like Linux has more vulnerabilities per line of Rust code than line of C code, given the language ratio...
        Ygg2 3mo ago
        Sure, but C code is way older so most of the bugs there should have been excised by now...
        ssokolow 2mo ago
        Here's a better exploration of defect rates: https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html https://security.googleblog.com/2022/12/memory-safe-language...
      - himata4113 3mo ago
        This is pretty hard to argue since for example: WireGuard is a finished piece of software. It gets: no feature updates, was designed in-full before a single line of code was written and has stood the test of time. You cannot compare that to some desktop application that has a thousand features with 100's more added every year.
  - kelnos 3mo ago
    I don't think we should set our expectations based on an extreme outlier. qmail is special, and we can't expect most software to get to its level of security/safety. Put another way: if you have to rely on programmer skill or attention to detail in order to guarantee something, that will always be a losing bet, on average. The existence of a tiny percentage of programmers that can clear that high bar does not make it a valid strategy.
    - inigyou 3mo ago
      Why can't we write everything like qmail?
    - uecker 3mo ago
      Splitting programs into mutually untrusting modules is a plausible alternative to memory safety in programming languages. Also in a program similar to qmail, memory safety alone is not sufficient, a lot of bugs in sendmail were related to complexity issues.
      - pjmlp 3mo ago
        If only there was an OS design architecture that would follow such approach from the ground up....
dns_snek 3mo ago
> memory safety might be the difference between the software engineering and Software Engineering. As in, an actual Engineering discipline. I wouldn't go that far, what matters is the finished whole. Memory safety of the finished program is a critical factor and using a memory safe language makes it easier to achieve that goal. However simply using a memory safe language doesn't make you a "Software Engineer" any more than using a certified I-beam makes someone a "Civil Engineer". What matters is that the finished structure/program meets the explicit and implicit requirements of safety, functionality, durability, cost, etc. Not to mention that complex reliable systems are usually engineered out of much less reliable components.
- inigyou 3mo ago
  Overall safety matters. Memory safety is just one factor. Log4Shell happened in Java, a GC language without pointer arithmetic.
  - Ygg2 3mo ago
    With Fil-C and Rust the memory safety shouldn't even be discussed. It should be the bare minimum. Presence of worse bugs won't make memory bugs disappear.
  - pjmlp 3mo ago
    Using seat belts is just one factor. People still die while wearing one, so it should not be compulsory. Is how this kind of arguments always get received by security folks.
- satvikpendem 3mo ago
  Necessary versus sufficient condition, as they say in philosophy.
goalieca 3mo ago
There are engineering standards where dynamic allocation and especially garbage collectors are banned. C is actually a perfectly approved language in these cases.

himata4113 3mo ago

There are too many opensource projects that show that even with good engineering discipline humans are flawed creatures. Memory safety is just little thing that makes sure that when you write code at 4am that it will not leak memory via trivial mistakes such as forgetting to free something, freeing something twice or passing a freed pointer. I believe AI agents shine here the most because the they do not get tired and are getting pretty damn predictable.

deleted 3mo ago
[deleted]
inigyou 3mo ago
How many bugs in qmail though?
- himata4113 3mo ago
  It had one bad cve it seems, but that's exactly what I mean. It only takes one mistake, of course you can learn and never make those mistakes again, however, that is an unrealistic expectation in software that receives hundreds of feature updates a year especially when it comes to core applications as basic as communication when it wants to support image previews, reels and whatnot.
  - Brian_K_White 3mo ago
    There will always be one, so "it only takes one" is meaningless and invalid. That leaves less is better than more, and any form of less is as good as any other form of less.
    - deleted 3mo ago
      [deleted]
    - inigyou 3mo ago
      Some Rust programs also had RCE CVEs.
      - Ygg2 3mo ago
        Some is doing heavy misrepresentation. Latest batch of LLM's Linux had 423 vulnerabilities. Out of which 10 were Rust*. Would you prefer more or less CVEs? But it's like seat belt analogy. It's a helper not a panacea. * Granted Rust isn't in the entire kernel yet. D
        inigyou 3mo ago
        That sounds like Linux has more vulnerabilities per line of Rust code than line of C code, given the language ratio...
        Ygg2 3mo ago
        Sure, but C code is way older so most of the bugs there should have been excised by now...
        ssokolow 2mo ago
        Here's a better exploration of defect rates: https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html https://security.googleblog.com/2022/12/memory-safe-language...
    - himata4113 3mo ago
      This is pretty hard to argue since for example: WireGuard is a finished piece of software. It gets: no feature updates, was designed in-full before a single line of code was written and has stood the test of time. You cannot compare that to some desktop application that has a thousand features with 100's more added every year.
- kelnos 3mo ago
  I don't think we should set our expectations based on an extreme outlier. qmail is special, and we can't expect most software to get to its level of security/safety. Put another way: if you have to rely on programmer skill or attention to detail in order to guarantee something, that will always be a losing bet, on average. The existence of a tiny percentage of programmers that can clear that high bar does not make it a valid strategy.
  - inigyou 3mo ago
    Why can't we write everything like qmail?
  - uecker 3mo ago
    Splitting programs into mutually untrusting modules is a plausible alternative to memory safety in programming languages. Also in a program similar to qmail, memory safety alone is not sufficient, a lot of bugs in sendmail were related to complexity issues.
    - pjmlp 3mo ago
      If only there was an OS design architecture that would follow such approach from the ground up....

dns_snek 3mo ago

> memory safety might be the difference between the software engineering and Software Engineering. As in, an actual Engineering discipline. I wouldn't go that far, what matters is the finished whole. Memory safety of the finished program is a critical factor and using a memory safe language makes it easier to achieve that goal. However simply using a memory safe language doesn't make you a "Software Engineer" any more than using a certified I-beam makes someone a "Civil Engineer". What matters is that the finished structure/program meets the explicit and implicit requirements of safety, functionality, durability, cost, etc. Not to mention that complex reliable systems are usually engineered out of much less reliable components.

inigyou 3mo ago
Overall safety matters. Memory safety is just one factor. Log4Shell happened in Java, a GC language without pointer arithmetic.
- Ygg2 3mo ago
  With Fil-C and Rust the memory safety shouldn't even be discussed. It should be the bare minimum. Presence of worse bugs won't make memory bugs disappear.
- pjmlp 3mo ago
  Using seat belts is just one factor. People still die while wearing one, so it should not be compulsory. Is how this kind of arguments always get received by security folks.
satvikpendem 3mo ago
Necessary versus sufficient condition, as they say in philosophy.

goalieca 3mo ago

There are engineering standards where dynamic allocation and especially garbage collectors are banned. C is actually a perfectly approved language in these cases.