65 ms·

Ada (and I guess the other ones) are unlikely to be memory safe in the presence of arbitrary pointers without a GC. That is, having a pointer/reference deep int

by dbaupp 12y ago

Ada (and I guess the other ones) are unlikely to be memory safe in the presence of arbitrary pointers without a GC. That is, having a pointer/reference deep into a vector or some nested element of a tree requires a garbage collector or is unsafe (runs the risk of becoming dangling). So, while they are possibly better than C in many ways there are others in which they are lacking. This lack of references means code is forced to do more copies or data-structure lookups. (I dont actually know Ada or those other languages, but I did do some research a while ago and discussed this publically here and on /r/programming a few times, and have never been corrected, so I guess it is close to correct.)

kyllo 12y ago
having a pointer/reference deep into a vector or some nested element of a tree requires a garbage collector or is unsafe (runs the risk of becoming dangling) Yes, this is a problem, certain data structures need to be intrusive in order to be fast. Rust for example is a highly memory-safe language but its "unsafe" mechanism needs to be used in order to implement performant data structures for this reason. http://www.reddit.com/r/rust/comments/2jec05/problem_with_implementation_of_linked_list/ http://www.reddit.com/r/rust/comments/2jec05/problem_with_im...
- dbaupp 12y ago
  That is not what I'm talking about. e.g. (in Rust) let map: TreeMap<uint, SomeHugeThing> = make_map(); let value: Option<&SomeHugeThing> = map.find(&123); `map` is a (recursive) tree that associates a `uint` key with a value of type `SomeHugeThing`, imagine that is, e.g. 1KB, or otherwise expensive to copy. The `value` is a direct pointer to the memory of the value associated with the key 123 (if it exists), that is, it is extremely cheap to manipulate `value` because it is basically a machine pointer directly into the memory of the TreeMap. Rust gives you the power for that to be perfectly safe without a GC: there's no risk that changes to the `map` structure will cause the `value` pointer to be invalidated. As far as I know, Ada etc. do not allow for this without a GC. That is, there's no way to have a safe pointer directly into the memory controlled by some dynamic data structure. Instead, one would have to search the `map` each time the value is wanted, or turn on GC. > its "unsafe" mechanism needs to be used in order to implement performant data structures for this reason. Implement some performant data structures. There's a lot of data structures that can be implemented performantly without begin intrusive (sure, one might want to use `unsafe` occasionally to optimise them fully, but the `unsafe` is almost always not being used to make it intrusive). Also, I don't understand the relevance of that link, the top comment (which is mine, btw) clearly demonstrates that `unsafe` is not necessary.
pjmlp 12y ago
Ada specification allows for a GC, but few implementations provide one. Oberon and Modula-3 have GC and had real usable OS implemented in them, not just some kind of concept OS. However those languages already offer the following in terms of security over C: - String data type - Open arrays (aka slices nowadays) - Reference parameters (no need to pass pointers to functions/procedures) - Bound checked arrays (you can bounds checking off, if you really need it) - Pointer arithmetic is explicit operation - Casting between types is explicit - Enumerations are their own types, there is no implicit conversion to/from ints. While they still don't cover all use cases in terms of memory safety, they already cover quite a few scenarios that in C just lead to unsafe code without the help of a static analyser.

by dbaupp 12y ago

kyllo 12y ago

having a pointer/reference deep into a vector or some nested element of a tree requires a garbage collector or is unsafe (runs the risk of becoming dangling) Yes, this is a problem, certain data structures need to be intrusive in order to be fast. Rust for example is a highly memory-safe language but its "unsafe" mechanism needs to be used in order to implement performant data structures for this reason. http://www.reddit.com/r/rust/comments/2jec05/problem_with_implementation_of_linked_list/ http://www.reddit.com/r/rust/comments/2jec05/problem_with_im...

dbaupp 12y ago
That is not what I'm talking about. e.g. (in Rust) let map: TreeMap<uint, SomeHugeThing> = make_map(); let value: Option<&SomeHugeThing> = map.find(&123); `map` is a (recursive) tree that associates a `uint` key with a value of type `SomeHugeThing`, imagine that is, e.g. 1KB, or otherwise expensive to copy. The `value` is a direct pointer to the memory of the value associated with the key 123 (if it exists), that is, it is extremely cheap to manipulate `value` because it is basically a machine pointer directly into the memory of the TreeMap. Rust gives you the power for that to be perfectly safe without a GC: there's no risk that changes to the `map` structure will cause the `value` pointer to be invalidated. As far as I know, Ada etc. do not allow for this without a GC. That is, there's no way to have a safe pointer directly into the memory controlled by some dynamic data structure. Instead, one would have to search the `map` each time the value is wanted, or turn on GC. > its "unsafe" mechanism needs to be used in order to implement performant data structures for this reason. Implement some performant data structures. There's a lot of data structures that can be implemented performantly without begin intrusive (sure, one might want to use `unsafe` occasionally to optimise them fully, but the `unsafe` is almost always not being used to make it intrusive). Also, I don't understand the relevance of that link, the top comment (which is mine, btw) clearly demonstrates that `unsafe` is not necessary.

pjmlp 12y ago

Ada specification allows for a GC, but few implementations provide one. Oberon and Modula-3 have GC and had real usable OS implemented in them, not just some kind of concept OS. However those languages already offer the following in terms of security over C: - String data type - Open arrays (aka slices nowadays) - Reference parameters (no need to pass pointers to functions/procedures) - Bound checked arrays (you can bounds checking off, if you really need it) - Pointer arithmetic is explicit operation - Casting between types is explicit - Enumerations are their own types, there is no implicit conversion to/from ints. While they still don't cover all use cases in terms of memory safety, they already cover quite a few scenarios that in C just lead to unsafe code without the help of a static analyser.