6 ms·

I can't wait to try this. If it can just get to the level of the first F# plugin, I'll be so happy. If MS picked up interest in Rust that'd be even more amazin

I can't wait to try this. If it can just get to the level of the first F# plugin, I'll be so happy. If MS picked up interest in Rust that'd be even more amazing. And it'd actually solve their security problems, unlike the more and more convoluted codegen they're doing for C++. Edit: to be clear, I mean the security problems that their C++ codegen is trying to solve, like stack cookies, ASLR, or the new stuff they were boasting about at build in the ObjC VS2015 codegen video. (Some special function call thing that stores a map of legitimate function call targets and checks before calling.) All that stuff is eliminated by having a sound design in the first place.

steveklabnik 12y ago
There is no silver bullet. Nothing solves security problems. I like your enthusiasm though :)
- MichaelGG 12y ago
  No, but Rust solves the exact security problems that MS's codegen is trying to solve. Look at the Obj-C VS2015 video that was posted here a bit ago. They're constantly coming up with these crazy hacks to reduce the impact of lack of memory safety. It just seems so inelegant, such a waste of effort and intelligence. (I know, it's actually very useful, since MS is mostly C++, so mitigation is a real value.) And look at this month's security bulletin from Microsoft. Once again, memory safety appears to be the leading offender. This is the same as it's always been. MS's critical CVE would drop by over 90% (I think more, but it's been a while since I tallied them all up) just by having memory safety.
  - pjmlp 12y ago
    MS and anyone else that jumped on the C ship long time ago. These issues have been preached by us with experience in strong memory systems programming languages, e.g. Modula-2, Modula-3, Oberon, Ada, Pascal dialects... But the industry needs to be exploited every day, spend huge pile of money in memory integer validation tools, the workarounds you mention (other compiler vendors do it as well) and still keep on fixing memory corruption exploits. To eventually start caring about this issues. A visible side effect is the increase in Ada presence at FOSDEM in the last years, as well as, the industry acceptance of SPARK. Back in the day I went to C++ from Turbo Pascal, because at least the language provided the tools to write safe code, if (big if) I cared to use them. So there was a path to achieve Algol type of safety. The big issue is that due to its almost copy-paste compatibility with C, the added safety is not worth nothing if developers just keep on coding C with a C++ compiler. Rust might eventually also suffer from this, given the amount of unsafe being used, I keep on seeing in code examples.
- agapos 12y ago
  That is true, but I like to believe that if a group can solve a whole class of problems with a new language, that means they can spend more time and effort on other types of security problems.
pjmlp 12y ago
It is much more likely that the way forward lies in .NET Native than picking up Rust. According to the C++ code generation talk at Build, their new C2 compiler backend appears to evolve into something like how Apple is using LLVM for.
- cwyers 12y ago
  Microsoft has put effort into extending C# for systems programming: http://joeduffyblog.com/2013/12/27/csharp-for-systems-programming/ http://joeduffyblog.com/2013/12/27/csharp-for-systems-progra...
  - pjmlp 12y ago
    Yes, the famous M#. Maybe some of that work might flow back into C#.
  - pcunite 12y ago
    Would love this. I know it's not "easy" but would love to have a "delete" keyword.
    - MichaelGG 12y ago
      Offering manual memory management would be a huge win. Even if it's just hints. For instance, if a function was pure, then we know the arguments to it can't escape. So suddenly we can safely allocate many things right on the stack. This can be a huge win in high perf scenarios. I'd also love an arena system, so I could provide a context and allocate objects in it and enforce they never leak. (Say, per request in an HTTP app.) Then the GC could just free that chunk in one go, no matter how much garbage I've loaded in it. I know that generational GC is supposed to handle this in general, but it isn't free, plus fails when some requests take a long time (and thus all their stuff gets promoted).
- MichaelGG 12y ago
  What's .Net Native gotta do with it? Can that really provide the performance? Is MS gonna start using C# for perf work? You've still got the GC and no easy way to eliminate such things. And what's stopping the JIT from doing similar things?

steveklabnik 12y ago

There is no silver bullet. Nothing solves security problems. I like your enthusiasm though :)

MichaelGG 12y ago
No, but Rust solves the exact security problems that MS's codegen is trying to solve. Look at the Obj-C VS2015 video that was posted here a bit ago. They're constantly coming up with these crazy hacks to reduce the impact of lack of memory safety. It just seems so inelegant, such a waste of effort and intelligence. (I know, it's actually very useful, since MS is mostly C++, so mitigation is a real value.) And look at this month's security bulletin from Microsoft. Once again, memory safety appears to be the leading offender. This is the same as it's always been. MS's critical CVE would drop by over 90% (I think more, but it's been a while since I tallied them all up) just by having memory safety.
- pjmlp 12y ago
  MS and anyone else that jumped on the C ship long time ago. These issues have been preached by us with experience in strong memory systems programming languages, e.g. Modula-2, Modula-3, Oberon, Ada, Pascal dialects... But the industry needs to be exploited every day, spend huge pile of money in memory integer validation tools, the workarounds you mention (other compiler vendors do it as well) and still keep on fixing memory corruption exploits. To eventually start caring about this issues. A visible side effect is the increase in Ada presence at FOSDEM in the last years, as well as, the industry acceptance of SPARK. Back in the day I went to C++ from Turbo Pascal, because at least the language provided the tools to write safe code, if (big if) I cared to use them. So there was a path to achieve Algol type of safety. The big issue is that due to its almost copy-paste compatibility with C, the added safety is not worth nothing if developers just keep on coding C with a C++ compiler. Rust might eventually also suffer from this, given the amount of unsafe being used, I keep on seeing in code examples.
agapos 12y ago
That is true, but I like to believe that if a group can solve a whole class of problems with a new language, that means they can spend more time and effort on other types of security problems.

pjmlp 12y ago

It is much more likely that the way forward lies in .NET Native than picking up Rust. According to the C++ code generation talk at Build, their new C2 compiler backend appears to evolve into something like how Apple is using LLVM for.

cwyers 12y ago
Microsoft has put effort into extending C# for systems programming: http://joeduffyblog.com/2013/12/27/csharp-for-systems-programming/ http://joeduffyblog.com/2013/12/27/csharp-for-systems-progra...
- pjmlp 12y ago
  Yes, the famous M#. Maybe some of that work might flow back into C#.
- pcunite 12y ago
  Would love this. I know it's not "easy" but would love to have a "delete" keyword.
  - MichaelGG 12y ago
    Offering manual memory management would be a huge win. Even if it's just hints. For instance, if a function was pure, then we know the arguments to it can't escape. So suddenly we can safely allocate many things right on the stack. This can be a huge win in high perf scenarios. I'd also love an arena system, so I could provide a context and allocate objects in it and enforce they never leak. (Say, per request in an HTTP app.) Then the GC could just free that chunk in one go, no matter how much garbage I've loaded in it. I know that generational GC is supposed to handle this in general, but it isn't free, plus fails when some requests take a long time (and thus all their stuff gets promoted).
MichaelGG 12y ago
What's .Net Native gotta do with it? Can that really provide the performance? Is MS gonna start using C# for perf work? You've still got the GC and no easy way to eliminate such things. And what's stopping the JIT from doing similar things?