7 ms·

> We already have a problem with a massive, unreliable, insecure ecosystem of legacy C code A ton of the world's software with the highest reliability requirem

by trimbo 13y ago

> We already have a problem with a massive, unreliable, insecure ecosystem of legacy C code A ton of the world's software with the highest reliability requirements is written in C and C++. Nuclear power plants? Yes. [1] Joint Strike Fighter? Yes. [2] Mars rover? Yes. [3] Your Tesla? Yes [4] US telephone systems. Stock exchanges. Bloomberg. Your cell phone OS (incl. many years before smartphones). The list goes on and on. C and C++ are the most general and well-supported languages we have. They can solve problems on any architecture with a good tradeoff between efficiency and generality (over assembly) and predictable performance. Reliability and security requirements are up to the developer to impose on any language (see: the github PHP SQL injection search). C is not, in itself, a problem towards these goals and those who build upon C are always improving it [5]. [1] - http://www.nrc.gov/reading-rm/doc-collections/nuregs/contract/cr6463/ http://www.nrc.gov/reading-rm/doc-collections/nuregs/contrac... [2] - http://www.jsf.mil/downloads/down_documentation.htm http://www.jsf.mil/downloads/down_documentation.htm [3] - http://compass.informatik.rwth-aachen.de/ws-slides/havelund.pdf http://compass.informatik.rwth-aachen.de/ws-slides/havelund.... [4] - http://www.pcworld.com/article/260883/tesla_cto_talks_model_s_batteries_and_incar_linux.html http://www.pcworld.com/article/260883/tesla_cto_talks_model_... [5] - http://msdn.microsoft.com/en-us/library/8ef0s5kh.aspx http://msdn.microsoft.com/en-us/library/8ef0s5kh.aspx

betterunix 13y ago
"Reliability and security requirements are up to the developer to impose on any language" This is a common fallback in these discussions, but it is misguided. Yes, you have to work to make software secure in any language; no, this does not mean C is equivalent. In C, you still need to worry about high-level problems like SQL injection, while simultaneously having to worry about low-level problems like integer overflows, dangling pointers, etc. That critical systems have been written in C or C++ is not relevant -- it does not mean that it was a good idea to do so.
- trimbo 13y ago
  Well, I actually see that as an advantage vs. placing trust in an abstraction you have no control over that can provide security problems for you. So I guess we'll agree to disagree on this one. Curious though, in what would you implement the examples I gave?
  - claudius 13y ago
    The control software for the Ariane rockets is written in Ada, which is apparently meant to be especially ‘secure’/predictable. And promptly blew up the rocket.
    - ColinWright 13y ago
      As I understand it, this was in part specifically because they turned off the protection the language provided.
      - gnuvince 13y ago
        Exactly right.
    - jmilkbal 13y ago
      They took the code from the Ariane 4 and stuck it on the Ariane 5 assuming all would go fine. While a famous incident attributed to Ada, I can safely say that C and other popular languages have done far more damage. Even if not in terms of exploding rockets (I don't know), but time lost debugging, fiddling with checks that would be handled in other languages and so forth. I like to tell people with Ada I can spend my time adding value rather than fighting against the language because of it's minimalism and the bugs that come with that.
      - sigkill 13y ago
        Is Ada worth learning?
        jmilkbal 13y ago
        It's a very personal decision. :) You're not going to be popular on HN with a language like Ada. You're also probably not going to find a company looking for Ada developers, though I, myself, do Ada work for pay. The Ada way of doing things really is a whole other world with completely different goals in mind than what fanboys and fangirls (I'm using the term dismissively, but there are real problems with new languages) will tell you about the new language they're using that was thrown together last weekend. Ada, of course, is far from perfect, but the blemishes like unbounded string syntax (I hope to see that fixed next revision! Ada just had a new revision!) are not enough to put me off from all the safety and checking the language does for me. I must tell you that it was the winner of a DoD contest to create a kind of perfect language. There was a document called the Steelman that outlined everything the DoD's perfectly readable, maintainable, reliable, safe language would look like. Three of the four entries were Pascal-derived, not C! If there is one thing Ada will do for you, if you let it, is demolish your ego. Every stupid thing you do will be caught by the compiler and you will scorned. The compiler will piss and moan catch all sorts of fantastic errors that you'd have to pop into a debugger for in C. Some folks have this notion that they are infallible, but "to err is human", right? You're welcome to turn off the checks in specific instances or project-wide (if you're nuts), but this isn't me. I'd love to think it is—and I write pretty great Ada these days—and I still don't have the gaul to turn off compiler checks. Everything isn't a pointer in Ada, we can nest functions. Hell we nest packages and do sorts of things that just don't translate to Java, C++ or C, but now I'm just rambling. I think Ada is a great choice for anything more than a shell script. Learning it introduces you more to a software engineering mindset because the language is built for software engineering, not hacking something together— though, in time, you will be capable of it. It's not the change of mindset like switching from procedural to functional, but it may be just as enlightening.
- _pmf_ 13y ago
  > while simultaneously having to worry about low-level problems like integer overflows Integer overflows are exactly the same in Java and C# as they are in C.
  - jasomill 13y ago
    No! Signed integer overflow in C/C++ is undefined. In other words, the language specifications permit implementations to do anything whatsoever[1]. This is emphatically not the case with either Java or C#. As an example, per the spec, with respect to C# integer multiplication, In a checked context, if the product is outside the range of the result type, a System.OverflowException is thrown. In an unchecked context, overflows are not reported and any significant high-order bits outside the range of the result type are discarded. In other words, while integer overflow isn't necessarily checked, unlike C/C++, C# isn't allowed to corrupt memory, violate runtime security guarantees, format your hard drive, threaten the President, or launch a video game[2] on integer overflow. [1] http://blog.llvm.org/2011/05/what-every-c-programmer-should-know.html http://blog.llvm.org/2011/05/what-every-c-programmer-should-... [2] http://feross.org/gcc-ownage/ http://feross.org/gcc-ownage/
1123581321 13y ago
The use of C and C-likes by the JPL rather than Lisp is a sad story; it means robotics has not advanced as fast as it could have. http://www.flownet.com/gat/jpl-lisp.html http://www.flownet.com/gat/jpl-lisp.html
- LowKarmaAccount 13y ago
  I love the postscript of this: "It is nonetheless supremely ironic that the demise of Lisp at JPL was ultimately due in no small measure to the unreliability of a C program."
oinksoft 13y ago
Several of your examples are hard real-time systems. Garbage collectors, schedulers, etc. are a no-go in such environments, so you won't see much Python or JavaScript there, but that doesn't discount the value of those languages. Note that Ada, a high level language, is used in similar systems, and that Lisp has been used in NASA satellites. High-level languages like Erlang are used in telecom systems and other critical network applications. The fact is, languages created in the early history of computer programming have had the opportunity to be used in high profile projects like the ones you brought up. In time, you will undoubtedly see Python and others used in such contexts.
ssw1n 13y ago
Let me add in one: [6] Fire Safety and Building Security Systems? Yes

by trimbo 13y ago

betterunix 13y ago

"Reliability and security requirements are up to the developer to impose on any language" This is a common fallback in these discussions, but it is misguided. Yes, you have to work to make software secure in any language; no, this does not mean C is equivalent. In C, you still need to worry about high-level problems like SQL injection, while simultaneously having to worry about low-level problems like integer overflows, dangling pointers, etc. That critical systems have been written in C or C++ is not relevant -- it does not mean that it was a good idea to do so.

trimbo 13y ago
Well, I actually see that as an advantage vs. placing trust in an abstraction you have no control over that can provide security problems for you. So I guess we'll agree to disagree on this one. Curious though, in what would you implement the examples I gave?
- claudius 13y ago
  The control software for the Ariane rockets is written in Ada, which is apparently meant to be especially ‘secure’/predictable. And promptly blew up the rocket.
  - ColinWright 13y ago
    As I understand it, this was in part specifically because they turned off the protection the language provided.
    - gnuvince 13y ago
      Exactly right.
  - jmilkbal 13y ago
    They took the code from the Ariane 4 and stuck it on the Ariane 5 assuming all would go fine. While a famous incident attributed to Ada, I can safely say that C and other popular languages have done far more damage. Even if not in terms of exploding rockets (I don't know), but time lost debugging, fiddling with checks that would be handled in other languages and so forth. I like to tell people with Ada I can spend my time adding value rather than fighting against the language because of it's minimalism and the bugs that come with that.
    - sigkill 13y ago
      Is Ada worth learning?
      - jmilkbal 13y ago
        It's a very personal decision. :) You're not going to be popular on HN with a language like Ada. You're also probably not going to find a company looking for Ada developers, though I, myself, do Ada work for pay. The Ada way of doing things really is a whole other world with completely different goals in mind than what fanboys and fangirls (I'm using the term dismissively, but there are real problems with new languages) will tell you about the new language they're using that was thrown together last weekend. Ada, of course, is far from perfect, but the blemishes like unbounded string syntax (I hope to see that fixed next revision! Ada just had a new revision!) are not enough to put me off from all the safety and checking the language does for me. I must tell you that it was the winner of a DoD contest to create a kind of perfect language. There was a document called the Steelman that outlined everything the DoD's perfectly readable, maintainable, reliable, safe language would look like. Three of the four entries were Pascal-derived, not C! If there is one thing Ada will do for you, if you let it, is demolish your ego. Every stupid thing you do will be caught by the compiler and you will scorned. The compiler will piss and moan catch all sorts of fantastic errors that you'd have to pop into a debugger for in C. Some folks have this notion that they are infallible, but "to err is human", right? You're welcome to turn off the checks in specific instances or project-wide (if you're nuts), but this isn't me. I'd love to think it is—and I write pretty great Ada these days—and I still don't have the gaul to turn off compiler checks. Everything isn't a pointer in Ada, we can nest functions. Hell we nest packages and do sorts of things that just don't translate to Java, C++ or C, but now I'm just rambling. I think Ada is a great choice for anything more than a shell script. Learning it introduces you more to a software engineering mindset because the language is built for software engineering, not hacking something together— though, in time, you will be capable of it. It's not the change of mindset like switching from procedural to functional, but it may be just as enlightening.
_pmf_ 13y ago
> while simultaneously having to worry about low-level problems like integer overflows Integer overflows are exactly the same in Java and C# as they are in C.
- jasomill 13y ago
  No! Signed integer overflow in C/C++ is undefined. In other words, the language specifications permit implementations to do anything whatsoever[1]. This is emphatically not the case with either Java or C#. As an example, per the spec, with respect to C# integer multiplication, In a checked context, if the product is outside the range of the result type, a System.OverflowException is thrown. In an unchecked context, overflows are not reported and any significant high-order bits outside the range of the result type are discarded. In other words, while integer overflow isn't necessarily checked, unlike C/C++, C# isn't allowed to corrupt memory, violate runtime security guarantees, format your hard drive, threaten the President, or launch a video game[2] on integer overflow. [1] http://blog.llvm.org/2011/05/what-every-c-programmer-should-know.html http://blog.llvm.org/2011/05/what-every-c-programmer-should-... [2] http://feross.org/gcc-ownage/ http://feross.org/gcc-ownage/

1123581321 13y ago

The use of C and C-likes by the JPL rather than Lisp is a sad story; it means robotics has not advanced as fast as it could have. http://www.flownet.com/gat/jpl-lisp.html http://www.flownet.com/gat/jpl-lisp.html

LowKarmaAccount 13y ago
I love the postscript of this: "It is nonetheless supremely ironic that the demise of Lisp at JPL was ultimately due in no small measure to the unreliability of a C program."

oinksoft 13y ago

Several of your examples are hard real-time systems. Garbage collectors, schedulers, etc. are a no-go in such environments, so you won't see much Python or JavaScript there, but that doesn't discount the value of those languages. Note that Ada, a high level language, is used in similar systems, and that Lisp has been used in NASA satellites. High-level languages like Erlang are used in telecom systems and other critical network applications. The fact is, languages created in the early history of computer programming have had the opportunity to be used in high profile projects like the ones you brought up. In time, you will undoubtedly see Python and others used in such contexts.

ssw1n 13y ago

Let me add in one: [6] Fire Safety and Building Security Systems? Yes