uecker

35 ms·

841.
by uecker 1y ago
I don't think this is the only takeway. My point is that you can reliably identify signed integer overflow using sanitizers and you can also reliably mitigate related attacks by trapping for signed integer overflow (it still may be a
842.
by uecker 1y ago
I think the C standard should provide some good libraries, e.g. a string library. But in any case the problem with 100000+ bespoke implementations in C is not fixed by designing new programming languages and also adding them to the mix.
843.
by uecker 1y ago
If you want something fool-proof where a statistical code generated will not generate issues, then C is certainly not a good choice. But also for other languages this will cause issues. I think for vibe-coding a network server you might
844.
by uecker 1y ago
I agree that the first reaction usually is only about what one is used to. I have seen this many times. Still, of course, not all syntax is equally good. For example, the problem with Vec<Vec<T>> for a 2D array is not that one
845.
by uecker 1y ago
I think the correct comparison is a sharp knife. It is extremely useful and while there is a risk it is fully acceptable. The idea that we should all use plastic knifes because there are often accidents with knifes is wrong and so is the i
846.
by uecker 1y ago
GCC's sanitizer does not catch unsigned wraparound. But the bigger problem is that a lot of code is written where it assumes that unsigned wraps around and this is ok. So you you would use a sanitizer you get a lot of false positives.
847.
by uecker 1y ago
Compared to other languages, this is still nice.
848.
by uecker 1y ago
I prefer C to Zig. IMHO all the successor languages throw out the baby with the bathwater and add unnecessary complexity. But Zig is much better than Rust, but, still, I would never use it for a serious project. The "promoting unexpect
849.
by uecker 1y ago
I strategy that helps me is just not use open-coded pointer arithmetic or string manipulation but encapsulate those behind safe bounds-checked interfaces. Then essentially only life-time issues remain and for those I usually do have a simp
850.
by uecker 1y ago
I do not agree that the integer promotion or casting (?) rules are broken in C. That some people make mistakes because they do not know them is a different problem. The reason you should make length signed is that you can use the sanitizer
851.
by uecker 1y ago
Whatever index you compute can be checked against a bound.
852.
by uecker 1y ago
This is my point, programmers apparently fail to understand that they would need to push for changes at the compiler level. The committee is supposed to standardize what exist, it has no real power to change anything against the will of t
853.
by uecker 1y ago
Why is it harder?
854.
by uecker 1y ago
Indeed, this is what many people do. But even if you use dynamic memory, if you replace pointer arithmetic by array indexing, you get bounds checking. And in C this also works for arrays of run-time length.
855.
by uecker 1y ago
It still makes it possible to have bounds checking. (And it is also not true anymore for C2Y.)
856.
by uecker 1y ago
I am not convinced a strong type system helps with functional safety and I am not even deeply impressed by Rust's type system. The scientific literature does even seem even that clear about whether a strong type system substantially re
857.
by uecker 1y ago
C and C++ don't have such subset defined as part of their standard. Left to users means left to additional tools, which do exist. Rust only has memory safety by default, this is a small part of the problem and it is not clear to me th
858.
by uecker 1y ago
The C89/C90 wording change story is a myth. And I am not sure I understand your point about CompCert. The correctness proof of CompCert covers programs that have no UB. And programmers do have some choice and also some voice. But I d
859.
by uecker 1y ago
They are free to but not required. You can pick a different compiler, or you can configure your compiler to something else, if it provides such options. I always found it surprising that people did not reject clang for aggressively optimiz
860.
by uecker 1y ago
They only need trampolines when they access their local environment and you take their address. Without optimization a trampoline was generated whenever an address was taken, but I recently changed this in the development version of GCC to
861.
by uecker 1y ago
True, that part is different and not safe in C. Lifetime is something that will need new language extensions / annotations.
862.
by uecker 1y ago
I do not understand this comment. A stack access should never be more expensive than access to malloced data. This is easy to see: Malloc gives you a pointer. An address computation to find a variable on the stack also gives you a pointer b
863.
by uecker 1y ago
Also works in C: https://uecker.codeberg.page/2025-07-02.html
864.
by uecker 1y ago
And a segfault would be worse than a panic, data corruption or out of memory access are the problems. But in reality, most C programs I use daily have never crashed in decades.
865.
by uecker 1y ago
Considering that basically nobody uses Zig, I think most neutral third-parties seem to agree.
866.
by uecker 1y ago
For signed overflow you can just turn on the sanitizer in trapping mode. Exhaustive checks is also not that terrible.
867.
by uecker 1y ago
I am not interested in C++, it is also far too complex. In my opinion software needs to become simpler and not more complicated, and I fear Rust might be a step into the wrong direction.
868.
by uecker 1y ago
Fair enough. I just find it mind boggling how much money flows into completely new language ecosystems compared to improvements for C/C++ tooling which would clearly much more effective if you really cared about overall security of the
869.
by uecker 1y ago
I guess this depends on what you consider good tooling. I am relatively happy with C tooling. But if you want to quickly assemble something from existing libraries, then language-level package managers like npm, cargo, pip are certainly s
870.
by uecker 1y ago
Rust is a nice language, but it pushed too aggressively with the argument of "memory safety" at all cost ignoring other considerations. And Cargo is certainly a disaster even though it may be considered "fantastic tooling&quo

More ›