4 ms·

On the other hand, Rust is not ready -- either from a stability or library perspective -- in 2015, most likely. What are you recommending the C/C++ programmers

On the other hand, Rust is not ready -- either from a stability or library perspective -- in 2015, most likely. What are you recommending the C/C++ programmers go to?

tptacek 12y ago
Java. Python. Golang. Lua.
- plinkplonk 12y ago
  (Just trying for clarity, not arguing against or opposing your point) In an earlier comment you used as an example of an unforced error "we wrote our custom database engine that only ever runs serverside in C". Are you saying (with this comment) that for such use cases, developers should use Java/Python/Go/Lua (vs C/C++)?
  - jerven 12y ago
    Yes, because you remove a whole class of errors that might be exploited. Might be hard, might even be impossible, but they are there waiting to be taken advantage of. Interestingly enough, very high performance java is a bit like rust. Almost all memory safe, except a few (10-100) lines off crazy unsafe stuff. Of course it is possible that your C code has no memory issues and is verified to be safe, but I would not bet any money on it. Also at the moment custom code is the last entry point for a hacker, but once all other things are hardend its the last guaranteed leak in the ship. I also understand where C semantics can lead to faster code than e.g. java today. But I suspect that edge to disappear within the next 3 years. Just like java is going to make heterogeneous compute easy its also going to improve streaming over memory for speed where needed.
- oscargrouch 12y ago
  If you are using C or C++, it probably means you cant use those you have pointed out. People can port Python and Ruby stuff to Go for instance and have advantages doing it, because the logic was already suited for managed languages. But for C and C++ stuff is unlikely.. and for Rust the other possible option.. its kind of a productivity killer compared to C (even with the headers nonsense). Its always a matter of tradeoff, and its not a casuality that C are alive and kicking til this day.. the language really has its strenghts.. and while every new lang in town claim they are the next C killer, well, in real life is much harder to make such a claim, and its not just because of the "old code that has to be maintained". I know you are a security focused person, but security and safety is not the only one reason we choose a language to start a new project. So until a really strong contender shows up (i particularly dont think Rust is it, but im sure there is a golden niche for it), they will still be with us, til we brake the current computation paradigm and algol and lisp langs doesnt make sense

On the other hand, Rust is not ready -- either from a stability or library perspective -- in 2015, most likely. What are you recommending the C/C++ programmers go to?

tptacek 12y ago

Java. Python. Golang. Lua.

plinkplonk 12y ago
(Just trying for clarity, not arguing against or opposing your point) In an earlier comment you used as an example of an unforced error "we wrote our custom database engine that only ever runs serverside in C". Are you saying (with this comment) that for such use cases, developers should use Java/Python/Go/Lua (vs C/C++)?
- jerven 12y ago
  Yes, because you remove a whole class of errors that might be exploited. Might be hard, might even be impossible, but they are there waiting to be taken advantage of. Interestingly enough, very high performance java is a bit like rust. Almost all memory safe, except a few (10-100) lines off crazy unsafe stuff. Of course it is possible that your C code has no memory issues and is verified to be safe, but I would not bet any money on it. Also at the moment custom code is the last entry point for a hacker, but once all other things are hardend its the last guaranteed leak in the ship. I also understand where C semantics can lead to faster code than e.g. java today. But I suspect that edge to disappear within the next 3 years. Just like java is going to make heterogeneous compute easy its also going to improve streaming over memory for speed where needed.
oscargrouch 12y ago
If you are using C or C++, it probably means you cant use those you have pointed out. People can port Python and Ruby stuff to Go for instance and have advantages doing it, because the logic was already suited for managed languages. But for C and C++ stuff is unlikely.. and for Rust the other possible option.. its kind of a productivity killer compared to C (even with the headers nonsense). Its always a matter of tradeoff, and its not a casuality that C are alive and kicking til this day.. the language really has its strenghts.. and while every new lang in town claim they are the next C killer, well, in real life is much harder to make such a claim, and its not just because of the "old code that has to be maintained". I know you are a security focused person, but security and safety is not the only one reason we choose a language to start a new project. So until a really strong contender shows up (i particularly dont think Rust is it, but im sure there is a golden niche for it), they will still be with us, til we brake the current computation paradigm and algol and lisp langs doesnt make sense