3 ms·

Yes I understand you are a master kernel hacker uber programmer. I understand you absolutely positively need bare metal performance. However the vast majority

Yes I understand you are a master kernel hacker uber programmer. I understand you absolutely positively need bare metal performance. However the vast majority of all C code ever written does not; most code is written by mere mortals and contains various bugs, including memory bugs and undefined behavior. Why can't the C standards committee introduce a memory safe mode for C? Make it opt-in. Prohibit aliasing without special overriding casts. Bounds check array accesses. I'm willing to trade some performance to prevent the next Heartbleed; I can throw VMs at my problems very cheaply. Having to tell everyone on the Internet to change their passwords (and every server op to get a new SSL key) is a multi-billion dollar waste of human capital for no reason. And that's just one C memory error. New zero day vulnerabilities, many due to C memory errors are continuously discovered. How many more Heartbleeds does it take?

jeffreyrogers 12y ago
I think there are compiler flags available that will do this (at least the bounds checking). When talking about C it's important to understand why the standard is the way it is. C was designed to be a portable language. Not in the sense that code is easily portable, but that the language itself is easily portable by writing a new compiler for it on whatever OS you're using. As such, the C standard is written to make C an easy language to write a compiler for, which is why it has so much undefined behavior.
- desdiv 12y ago
  I don't think bounds checking can be done at compile time. Otherwise Java, Rust, Go et al. wouldn't need to incur the runtime overhead of the extra bookkeeping int per array.
  - jonhohle 12y ago
    -fbounds-checking, I'm sure there is a runtime cost, but it's provided by the compiler.
    - rst 12y ago
      Not applicable to C -- "Currently only supported by the Java and Fortran front ends." https://gcc.gnu.org/onlinedocs/gcc-4.9.2/gcc/Code-Gen-Options.html#Code-Gen-Options https://gcc.gnu.org/onlinedocs/gcc-4.9.2/gcc/Code-Gen-Option... There have been bounds-checked implementations of C, but the runtime cost is very large. The problem is that to do it, you need to check not only explicit array references, but pointer dereferences as well -- and in order to make that work, each pointer needs to carry around with it its associated bounds. That, in turn, means that your pointer representation has to be something more (or other) than just a plain machine address.
  - kibwen 12y ago
    I'm not an expert, but you can do this in a language with dependent types such as Idris. But given the historical progress of the industry, it will probably be a long, long time before such an idea percolates down into an industrial language.
ars 12y ago
> Why can't the C standards committee Wrong people. It would be the compiler writers who would do that, since they know the target machine.

jeffreyrogers 12y ago

I think there are compiler flags available that will do this (at least the bounds checking). When talking about C it's important to understand why the standard is the way it is. C was designed to be a portable language. Not in the sense that code is easily portable, but that the language itself is easily portable by writing a new compiler for it on whatever OS you're using. As such, the C standard is written to make C an easy language to write a compiler for, which is why it has so much undefined behavior.

desdiv 12y ago
I don't think bounds checking can be done at compile time. Otherwise Java, Rust, Go et al. wouldn't need to incur the runtime overhead of the extra bookkeeping int per array.
- jonhohle 12y ago
  -fbounds-checking, I'm sure there is a runtime cost, but it's provided by the compiler.
  - rst 12y ago
    Not applicable to C -- "Currently only supported by the Java and Fortran front ends." https://gcc.gnu.org/onlinedocs/gcc-4.9.2/gcc/Code-Gen-Options.html#Code-Gen-Options https://gcc.gnu.org/onlinedocs/gcc-4.9.2/gcc/Code-Gen-Option... There have been bounds-checked implementations of C, but the runtime cost is very large. The problem is that to do it, you need to check not only explicit array references, but pointer dereferences as well -- and in order to make that work, each pointer needs to carry around with it its associated bounds. That, in turn, means that your pointer representation has to be something more (or other) than just a plain machine address.
- kibwen 12y ago
  I'm not an expert, but you can do this in a language with dependent types such as Idris. But given the historical progress of the industry, it will probably be a long, long time before such an idea percolates down into an industrial language.

ars 12y ago

> Why can't the C standards committee Wrong people. It would be the compiler writers who would do that, since they know the target machine.