9 ms·

I wonder when will people realise that writing browsers in a language like C++ is not a good idea if you're semi-serious about security.

by fijal 13y ago

CJefferson 13y ago
What do you think a sensible alternative is? I have serious problems with C++, but few people (including me) would accept a "security upgrade" which made my browser significantly slower and memory hungry.
- wyager 13y ago
  Rust or Go would be pretty straightforward replacements for C++. Mozilla is actively using Rust to make Servo. I think both Rust and Go are less conducive to bugs than C++. There are other languages that could be used to write very secure browsers, but using them wouldn't necessarily be straightforward.
  - CJefferson 13y ago
    Certainly Rust is aimed in that direction. I'm unconvinced one could (for example) write a high-performance javascript JIT in Go. Also, neither of those languages has been around anywhere near long enough for a browser to be written in this (Rust still isn't finished!), so insulting people for writing browsers in C++ without suggesting a useful alternative doesn't seem very sensible.
  - deluvas 13y ago
    Mind if I ask, what's up with these languages, showing up everywhere on (Rust/Go)? Are they that useful? Can you summarize for me what are they good at?
    - wyager 13y ago
      They're relatively straightforward procedural object-oriented languages. They're not amazing. They won't make you say "Wow, that's awesome!" when you use them. They do have a few practical advantages over C++. For one, they don't allow dangerous things like pointer manipulation. They both support garbage collection. Go has some nice built-in support for multithreading. Both have some nice iteration features. Useful syntactic sugar. Stuff like that. Where C++ is basically just C with random features shoddily spot-welded on in different places, Go and Rust were designed from the ground up to be relatively very simple and straightforward. Like I said, they're not amazing; they're just better than C++.
      - kibwen 13y ago
        I dunno, for those of us who had no idea that it was possible to be provably memory-safe with zero runtime overhead, Rust is pretty amazing. :P
        pjmlp 13y ago
        Really?!? Modula-2 was created in 1978! Just to cite one memory safe systems programming language.
        jerf 13y ago
        Common practice programming languages like Go are getting into the 1980s or so, research-wise. The Haskell community is into the 90s, along with some genuinely new stuff. Both have a long way to go before they're accepted common practice. For as fast and as furious a pace as the world of computer programming likes to think it runs at, there is an unbelievably long line to get something from research to common practice. It's literally decades long. Though there are some reasons for this; there's a difference between doing a research compiler and doing something that can actually be deployed in the harsh environment of the real world. Still, the world of computer programming does not advance anywhere near as quickly as it fancies itself doing.
        pcwalton 13y ago
        > Common practice programming languages like Go are getting into the 1980s or so, research-wise. The Haskell community is into the 90s, along with some genuinely new stuff. Both have a long way to go before they're accepted common practice. Rust actually uses new stuff; the borrow checker builds on old ideas from Cyclone and others from the 90s, but it mixes it with some interesting research ideas of its own (using C++ destructors to get region typing at the level of individual values, not of regions) to come up with something that's actually fairly novel.
        jerf 13y ago
        Well, I hardly set out to show the entire range of new stuff in two paragraphs... :) But I'd also observe that Rust has a ways to go before being common practice, too. More power to you, for the love of all that's holy please put a bullet in C and C++, but even in the best case scenario you're still at least three or four years away from even being solid B-list (Perl, Python, etc... Go isn't there yet either, FWIW).
    - kibwen 13y ago
      The purpose of Rust is to be as efficient and deterministic as C++ while being as memory-safe as high-level languages, and while also being designed from the ground-up to support concurrency in a way that is lightweight and safe (i.e. guarantees that you cannot race on data).
    - chowells 13y ago
      Rust is a brilliant idea. Apply some of the last 50 years of programming languages advances to a low-level language. And they're enthusiastic about incorporating more of them, as they have time to implement them. Go is just another language that ignored the last 50 years of programming language advances in order to not scare C programmers who are afraid of learning anything new.
      - krick 13y ago
        By the way, are there some ideas when Rust can become more or less production-ready?
- pjmlp 13y ago
  Modula-2 was a possible alternative around the early 80's, back when C compilers were still slower than dumb written Assembly language on micro-computers. Sadly UNIX spread into the enterprise and with it brought C to the masses and spread the doom of security we still enjoy. C++ is way safer than C, if one use modern C++ instead of C underpinning that allowed the language to become mainstream. Now, we have to hope languages like Rust and D might recover what Ada, Modula-2 did not managed to become.
  - krick 13y ago
    Ada is too complex. It might be acceptable if you are talking about small group of specialists that always produce nice code, but large open-source project in Ada… Well, I'm not sure it's better than C++.
    - renox 13y ago
      > Ada is too complex. Compared to what? C++? You're joking right?? > Well, I'm not sure it's better than C++. I disagree, Ada is complex ok, but its default behaviour is much better for security than C++.
      - krick 13y ago
        > You're joking right?? Not at all. Well, maybe not compared to C++, but still, it doesn't seem like really plausible alternative, that can be recommended and seriously used in a complex application. Dijkstra agrees. ;) > but its default behaviour is much better for security than C++ Oh, sure. But that could be said about pretty much every language out there. Somebody recommends Haskell. Haskell's default behavior is way better than C++. It's not enough. Actually, I never saw big projects in Ada, so I can be wrong, but it seems to me that for typical more or less sane programmer might be even easier to write hard-to-understand code in Ada than in C++, even though Ada is much better designed. The reason is that C++ complexity is well known, many of it's features considered dangerous and most of people seem to avoid them. That's not true for Ada, and it's also very feature-rich. If anything: there are many things about Ada I like. Its data type system, for example. It's really a shame that after C many programmers somehow "forgot" that all that stuff exists.
- lhgaghl 13y ago
  Off the top of my head, any of these would have been a much more sane choice: Standard ML, Ada, Java, concatenative languages, E, Lisp, Haskell, Erlang, Python. > few people (including me) would accept a "security upgrade" which made my browser significantly slower and memory hungry. I can't tell if this is a joke. You know practically website is constantly running the shittiest JS you can imagine (and sometimes Actionscript), right? Even if the language somehow can't handle implementing a certain task efficiently, you could still make a separate OS process for say, decoding the video stream, and passing it back to the safe code. If you think there is a technical reason that browsers/OS today are written in C/C++ you are wrong. The reasons are purely circumstantial. Also note that most C/C++ coders aren't aware that other languages even exist or are practical, so good luck getting them to switch.
  - krick 13y ago
    God, I hate that "link expired" stuff. I wrote you a pretty long response and failed to save it in exchange buffer. It was covering every language you mentioned (except Java, which also is pretty horrible), but as I'm not willing to reproduce it, so let's concentrate on what bothers me: Haskell. So, the essential. If Haskell is "better" than someting else, then, by definition, it's easier to write good software in it. I wrote about my personal experience in the lost reply, but it doesn't really matter. The question is, why people who believe that Haskell is better for writing browsers won't prove it themself? By doing, I mean. I haven't seen a popular (lets take it as quality measure) browser, P2P client, feature-full messaging client/service or image editing app written in Haskell. Only pandoc, Xmonad, Yi and countless links to haskell.org success-story page, which isn't working app. Actually, it's true for any language, but nothing is mentioned as often as Haskell.
    - lhgaghl 13y ago
      > God, I hate that "link expired" stuff. Heh, I use tor, and it just took me over 10 tries to login to reply to you (changing exit nodes to find one that isn't blocked, etc). If you don't like Haskell for some reason, replace it with something else. Heck, a browser in pure JS would be preferable to a browser in C (note: it doesn't count if you have 50 libraries implementing audio/visual/crypto/compression written in C and linked into the same address space as the JS). But it takes huge capital to implement a browser, and you'll still have the other issues like CSRF, clickjacking, phishing (each of which have been solved ages ago by waterken btw: http://waterken.sourceforge.net/web-key/ http://waterken.sourceforge.net/web-key/), X.509 (which has been solved by tor hidden addresses and other systems like it), and other mystical issues that arise because of how incoherently-designed the web is. Anyways, why do you think C would be any better for implementing a browser than any of these languages?
- renox 13y ago
  >What do you think a sensible alternative is? "sensible" is all in the eye of the beholder, once you have your computer hacked your priorities may change.. > but few people (including me) would accept a "security upgrade" which made my browser significantly slower and memory hungry. And THAT is the issue, security CANNOT be an afterthought.. Note that significantly slower doesn't mean slow, PC's CPUs are very, very fast.
kybernetikos 13y ago
The mozilla guys know this already. They've specifically talked about how many serious security bugs would have been caught by using a language like Rust.
hdevalence 13y ago
I'll just point out this thing over here: https://github.com/mozilla/servo https://github.com/mozilla/servo
- nightski 13y ago
  It is an interesting project but they have stated numerous times there are no plans to release it as an actual product.
deluvas 13y ago
Can you explain why that's not a good idea? I have no clue, really, but I'm guessing something about libraries.
- aroman 13y ago
  No, it's because writing software in C++ is like riding your bike in the middle lane of a highway with no helmet on. If you're really really careful, it can work fine, and your trip will be efficient and productive. But it's really hard to do it properly -- you could hit a car (buffer overflow), you could get hit by someone (heap overflow), or your brakes might give out (input sanitization fail). It's not that it's impossible or that it's a "bad idea", it's just that it'd be a lot safer to spend the extra resources on a motorcycle (Python) or an SUV (Rust).
  - TillE 13y ago
    C is irreducibly dangerous, but you can do quite a lot with C++ by avoiding legacy C stuff. Build almost everything on top of the STL and Boost, which are safe. And of course there are security bugs (eg, goto fail) that would affect any language.
    - pjmlp 13y ago
      Fully agree, mankind would be better without C and C++. But given they are the current mainstream options for the time of applications they are used to, better use modern C++ like you are advocating and stay as far as possible from any pure C constructs. Additionally use static analyser, enable all warnings as errors and turn on pedantic mode.
    - munin 13y ago
      > Build almost everything on top of the STL and Boost, which are safe. this is not really true, you can have temporal memory safety issues using STL and boost.
  - jkrems 13y ago
    The examples should be the other way around. Very safe and simple to drive but slower and not that powerful: bike an a proper bike lane (Python). Reasonably safe & fast: SUV (Rust). Really fast and you can do crazy things (drive on one wheel at 200km/h) but also enormously dangerous: Motorcycle (C/C++).
WizzleKake 13y ago
Maybe at the same time people realize that writing operating systems in a language like C is not a good idea if you're semi-serious about security. ...
Pacabel 13y ago
It has been tried before. One example I can think of immediately is Grail, which was implemented in Python: https://en.wikipedia.org/wiki/Grail_%28web_browser%29 https://en.wikipedia.org/wiki/Grail_%28web_browser%29 Another is HotJava, which was implemented in Java by Sun: https://en.wikipedia.org/wiki/HotJava https://en.wikipedia.org/wiki/HotJava The results were less than stellar. Neither browser was really comparable to contemporary browsers written in C or C++ in terms of features and performance. Those factors are just too important to overlook, even in the name of security.
nly 13y ago
Even for C++ we have the language, compiler and runtime features to mitigate the majority of these attacks. The problem is nobody wants to pay the runtime cost and/or risk breaking old binaries.

I wonder when will people realise that writing browsers in a language like C++ is not a good idea if you're semi-serious about security.

by fijal 13y ago

I wonder when will people realise that writing browsers in a language like C++ is not a good idea if you're semi-serious about security.

CJefferson 13y ago

What do you think a sensible alternative is? I have serious problems with C++, but few people (including me) would accept a "security upgrade" which made my browser significantly slower and memory hungry.

wyager 13y ago
Rust or Go would be pretty straightforward replacements for C++. Mozilla is actively using Rust to make Servo. I think both Rust and Go are less conducive to bugs than C++. There are other languages that could be used to write very secure browsers, but using them wouldn't necessarily be straightforward.
- CJefferson 13y ago
  Certainly Rust is aimed in that direction. I'm unconvinced one could (for example) write a high-performance javascript JIT in Go. Also, neither of those languages has been around anywhere near long enough for a browser to be written in this (Rust still isn't finished!), so insulting people for writing browsers in C++ without suggesting a useful alternative doesn't seem very sensible.
- deluvas 13y ago
  Mind if I ask, what's up with these languages, showing up everywhere on (Rust/Go)? Are they that useful? Can you summarize for me what are they good at?
  - wyager 13y ago
    They're relatively straightforward procedural object-oriented languages. They're not amazing. They won't make you say "Wow, that's awesome!" when you use them. They do have a few practical advantages over C++. For one, they don't allow dangerous things like pointer manipulation. They both support garbage collection. Go has some nice built-in support for multithreading. Both have some nice iteration features. Useful syntactic sugar. Stuff like that. Where C++ is basically just C with random features shoddily spot-welded on in different places, Go and Rust were designed from the ground up to be relatively very simple and straightforward. Like I said, they're not amazing; they're just better than C++.
    - kibwen 13y ago
      I dunno, for those of us who had no idea that it was possible to be provably memory-safe with zero runtime overhead, Rust is pretty amazing. :P
      - pjmlp 13y ago
        Really?!? Modula-2 was created in 1978! Just to cite one memory safe systems programming language.
        jerf 13y ago
        Common practice programming languages like Go are getting into the 1980s or so, research-wise. The Haskell community is into the 90s, along with some genuinely new stuff. Both have a long way to go before they're accepted common practice. For as fast and as furious a pace as the world of computer programming likes to think it runs at, there is an unbelievably long line to get something from research to common practice. It's literally decades long. Though there are some reasons for this; there's a difference between doing a research compiler and doing something that can actually be deployed in the harsh environment of the real world. Still, the world of computer programming does not advance anywhere near as quickly as it fancies itself doing.
        pcwalton 13y ago
        > Common practice programming languages like Go are getting into the 1980s or so, research-wise. The Haskell community is into the 90s, along with some genuinely new stuff. Both have a long way to go before they're accepted common practice. Rust actually uses new stuff; the borrow checker builds on old ideas from Cyclone and others from the 90s, but it mixes it with some interesting research ideas of its own (using C++ destructors to get region typing at the level of individual values, not of regions) to come up with something that's actually fairly novel.
        jerf 13y ago
        Well, I hardly set out to show the entire range of new stuff in two paragraphs... :) But I'd also observe that Rust has a ways to go before being common practice, too. More power to you, for the love of all that's holy please put a bullet in C and C++, but even in the best case scenario you're still at least three or four years away from even being solid B-list (Perl, Python, etc... Go isn't there yet either, FWIW).
  - kibwen 13y ago
    The purpose of Rust is to be as efficient and deterministic as C++ while being as memory-safe as high-level languages, and while also being designed from the ground-up to support concurrency in a way that is lightweight and safe (i.e. guarantees that you cannot race on data).
  - chowells 13y ago
    Rust is a brilliant idea. Apply some of the last 50 years of programming languages advances to a low-level language. And they're enthusiastic about incorporating more of them, as they have time to implement them. Go is just another language that ignored the last 50 years of programming language advances in order to not scare C programmers who are afraid of learning anything new.
    - krick 13y ago
      By the way, are there some ideas when Rust can become more or less production-ready?
pjmlp 13y ago
Modula-2 was a possible alternative around the early 80's, back when C compilers were still slower than dumb written Assembly language on micro-computers. Sadly UNIX spread into the enterprise and with it brought C to the masses and spread the doom of security we still enjoy. C++ is way safer than C, if one use modern C++ instead of C underpinning that allowed the language to become mainstream. Now, we have to hope languages like Rust and D might recover what Ada, Modula-2 did not managed to become.
- krick 13y ago
  Ada is too complex. It might be acceptable if you are talking about small group of specialists that always produce nice code, but large open-source project in Ada… Well, I'm not sure it's better than C++.
  - renox 13y ago
    > Ada is too complex. Compared to what? C++? You're joking right?? > Well, I'm not sure it's better than C++. I disagree, Ada is complex ok, but its default behaviour is much better for security than C++.
    - krick 13y ago
      > You're joking right?? Not at all. Well, maybe not compared to C++, but still, it doesn't seem like really plausible alternative, that can be recommended and seriously used in a complex application. Dijkstra agrees. ;) > but its default behaviour is much better for security than C++ Oh, sure. But that could be said about pretty much every language out there. Somebody recommends Haskell. Haskell's default behavior is way better than C++. It's not enough. Actually, I never saw big projects in Ada, so I can be wrong, but it seems to me that for typical more or less sane programmer might be even easier to write hard-to-understand code in Ada than in C++, even though Ada is much better designed. The reason is that C++ complexity is well known, many of it's features considered dangerous and most of people seem to avoid them. That's not true for Ada, and it's also very feature-rich. If anything: there are many things about Ada I like. Its data type system, for example. It's really a shame that after C many programmers somehow "forgot" that all that stuff exists.
lhgaghl 13y ago
Off the top of my head, any of these would have been a much more sane choice: Standard ML, Ada, Java, concatenative languages, E, Lisp, Haskell, Erlang, Python. > few people (including me) would accept a "security upgrade" which made my browser significantly slower and memory hungry. I can't tell if this is a joke. You know practically website is constantly running the shittiest JS you can imagine (and sometimes Actionscript), right? Even if the language somehow can't handle implementing a certain task efficiently, you could still make a separate OS process for say, decoding the video stream, and passing it back to the safe code. If you think there is a technical reason that browsers/OS today are written in C/C++ you are wrong. The reasons are purely circumstantial. Also note that most C/C++ coders aren't aware that other languages even exist or are practical, so good luck getting them to switch.
- krick 13y ago
  God, I hate that "link expired" stuff. I wrote you a pretty long response and failed to save it in exchange buffer. It was covering every language you mentioned (except Java, which also is pretty horrible), but as I'm not willing to reproduce it, so let's concentrate on what bothers me: Haskell. So, the essential. If Haskell is "better" than someting else, then, by definition, it's easier to write good software in it. I wrote about my personal experience in the lost reply, but it doesn't really matter. The question is, why people who believe that Haskell is better for writing browsers won't prove it themself? By doing, I mean. I haven't seen a popular (lets take it as quality measure) browser, P2P client, feature-full messaging client/service or image editing app written in Haskell. Only pandoc, Xmonad, Yi and countless links to haskell.org success-story page, which isn't working app. Actually, it's true for any language, but nothing is mentioned as often as Haskell.
  - lhgaghl 13y ago
    > God, I hate that "link expired" stuff. Heh, I use tor, and it just took me over 10 tries to login to reply to you (changing exit nodes to find one that isn't blocked, etc). If you don't like Haskell for some reason, replace it with something else. Heck, a browser in pure JS would be preferable to a browser in C (note: it doesn't count if you have 50 libraries implementing audio/visual/crypto/compression written in C and linked into the same address space as the JS). But it takes huge capital to implement a browser, and you'll still have the other issues like CSRF, clickjacking, phishing (each of which have been solved ages ago by waterken btw: http://waterken.sourceforge.net/web-key/ http://waterken.sourceforge.net/web-key/), X.509 (which has been solved by tor hidden addresses and other systems like it), and other mystical issues that arise because of how incoherently-designed the web is. Anyways, why do you think C would be any better for implementing a browser than any of these languages?
renox 13y ago
>What do you think a sensible alternative is? "sensible" is all in the eye of the beholder, once you have your computer hacked your priorities may change.. > but few people (including me) would accept a "security upgrade" which made my browser significantly slower and memory hungry. And THAT is the issue, security CANNOT be an afterthought.. Note that significantly slower doesn't mean slow, PC's CPUs are very, very fast.

kybernetikos 13y ago

The mozilla guys know this already. They've specifically talked about how many serious security bugs would have been caught by using a language like Rust.

hdevalence 13y ago

I'll just point out this thing over here: https://github.com/mozilla/servo https://github.com/mozilla/servo

nightski 13y ago
It is an interesting project but they have stated numerous times there are no plans to release it as an actual product.

deluvas 13y ago

Can you explain why that's not a good idea? I have no clue, really, but I'm guessing something about libraries.

aroman 13y ago
No, it's because writing software in C++ is like riding your bike in the middle lane of a highway with no helmet on. If you're really really careful, it can work fine, and your trip will be efficient and productive. But it's really hard to do it properly -- you could hit a car (buffer overflow), you could get hit by someone (heap overflow), or your brakes might give out (input sanitization fail). It's not that it's impossible or that it's a "bad idea", it's just that it'd be a lot safer to spend the extra resources on a motorcycle (Python) or an SUV (Rust).
- TillE 13y ago
  C is irreducibly dangerous, but you can do quite a lot with C++ by avoiding legacy C stuff. Build almost everything on top of the STL and Boost, which are safe. And of course there are security bugs (eg, goto fail) that would affect any language.
  - pjmlp 13y ago
    Fully agree, mankind would be better without C and C++. But given they are the current mainstream options for the time of applications they are used to, better use modern C++ like you are advocating and stay as far as possible from any pure C constructs. Additionally use static analyser, enable all warnings as errors and turn on pedantic mode.
  - munin 13y ago
    > Build almost everything on top of the STL and Boost, which are safe. this is not really true, you can have temporal memory safety issues using STL and boost.
- jkrems 13y ago
  The examples should be the other way around. Very safe and simple to drive but slower and not that powerful: bike an a proper bike lane (Python). Reasonably safe & fast: SUV (Rust). Really fast and you can do crazy things (drive on one wheel at 200km/h) but also enormously dangerous: Motorcycle (C/C++).

WizzleKake 13y ago

Maybe at the same time people realize that writing operating systems in a language like C is not a good idea if you're semi-serious about security. ...

Pacabel 13y ago

It has been tried before. One example I can think of immediately is Grail, which was implemented in Python: https://en.wikipedia.org/wiki/Grail_%28web_browser%29 https://en.wikipedia.org/wiki/Grail_%28web_browser%29 Another is HotJava, which was implemented in Java by Sun: https://en.wikipedia.org/wiki/HotJava https://en.wikipedia.org/wiki/HotJava The results were less than stellar. Neither browser was really comparable to contemporary browsers written in C or C++ in terms of features and performance. Those factors are just too important to overlook, even in the name of security.

nly 13y ago

Even for C++ we have the language, compiler and runtime features to mitigate the majority of these attacks. The problem is nobody wants to pay the runtime cost and/or risk breaking old binaries.