Live data from Hacker News

Getting Past C

blog.ntpsec.org

491–500 of 504 posts

Re: Getting Past C

#491
post #420

Earlier quoted context omitted.

Panics are definitely safe. They are significantly different than the segfault you'd get out of the C code.

There are tools you can use with C compilers that don't access OOB memory on OOB access. What's your point? I think I'd rather not have it panic at all. They were making a language from scratch and still didn't solve the crash-at-runtime problem that C has. Instead they just made a common C compiler option default and called it 'safe'. It's worse than the fact that the Go creators ignored years of research after the…

Which common C compiler has a production quality implementation of array bounds checking?

Before you say Address Sanitizer you should be aware that its authors intended it as a debugging tool and recommend against using it in production as it introduces new attack surface, as described in the "Address Sanitizer local root" mail.

http://seclists.org/oss-sec/2016/q1/363

Re: Getting Past C

#492

Earlier quoted context omitted.

> if you don't want to deal with copying structs, malloc them then push them to the dynamic array So, manually manage their memory allocation, but allow dynamic allocation of the array of pointers? Sure, there are some cases where that's useful, but if you're already managing memory for the structs themselves, you can probably just manage the memory for the array at the same time. > Else if you push a struct value on…

So, manually manage their memory allocation, but allow dynamic allocation of the array of pointers? Yes. Sure, there are some cases where that's useful, but if you're already managing memory for the structs themselves, you can probably just manage the memory for the array at the same time. ... then you have memory bugs. As your example code clearly shows. What you're suggesting (exposing the internal backing array of…

> All I can suggest is that you look up how dynamic arrays are typically implemented in C. The technique I describe is almost universally followed.

I think this gets at the crux of people's problem with the idea that you can just work around the problem of manually allocating memory. It's a bolt-on to the language, and the behavior is dependent on the implementation chosen, and it makes the behavior fundamentally different than "native" C arrays, to the point that it might cause problems.

> This is also what happens with std::vector in C++ - std::vector doesn't manage the memory of the elements themselves, just its internal backing array.

Yes, but there's also usage directions for std::vector that specifically state and make very clear what iterators/pointers are invalidated on what actions. Encountering someone's home-rolled array routines may or may not allow you to easily make the same deductions. Are the routines for dynamic arrays, or are they for doing system cleanup at the same time, or have they been combined? Are there comments noting the reason for what's being done, and that certain operations may invalidate pointers, or are you left to intuit that yourself?

These are the problems with having a non-core (and not even a popular implementation to fall back on) way to extend the language. C++ is a step up in that it at least standardizes a bunch of core types so you can learn those and carry your knowledge of how they work around to different projects in the language. C's lack of this means that every project may implement something like this - or not - in their own way, with subtle usage differences.

The main benefit you would get from Rust in a situation like this (ignoring that it would likely either be built in or readily available through a crate), is that on encountering some home-rolled system, you can look for where it uses unsafe to find any problematic behavior you need to be aware of, because otherwise you are fairly protected. Worst case, the whole home-rolled chunk of code is riddled with unsafe blocks, and you know it's definitely something you need to hunker down with to figure out what's going on (assuming you need to use it).

Rust's unsafe is effectively an enforced comment around dangerous code. Put that way, I'm not sure many C programmers would really object.

Re: Getting Past C

#493

Earlier quoted context omitted.

I'm not advocating use of C, just pointing out a simpler way to check dependencies. To answer your question though, the advantage of using C is certainly not the notorious bad-habits standard library. C is fun and productive exactly where there's just you and some bits and bytes to bang around. Coding in the small. Not platforms and architectures.

You can easily access external symbols in C without including a header. The external refs in an object file are the accurate info about what is referenced.

Granted. Just as you can easily corrupt memory.

Just as you can statically link libc, without it showing up in the symbol table.

Re: Getting Past C

#494
post #393
post #257

Earlier quoted context omitted.

This is actually a very helpful comment. I used to think "zero-cost" meant "at compile-time", as in `newtype` in Haskell, etc. I'm guessing that's what the parent commenter thought as well, and I'd guess is what most people think when they hear the phrase.

Well, you can still sort of view it that way. You can imagine the bounds check being a "compile time generation of the C code you'd write to check the bounds anyway".

The difference is that it's not dealt with entirely in the compile phase. i.e. language features that are checked at compilation and known to be true that are not needed at runtime.

The Haskell `newtype` example I gave was meant to illustrate this, as newtype's are respected by the type system and then are treated as the underlying type at runtime.

Re: Getting Past C

#495
post #401

Looking at the current new and coming languages I would take a hard look at NIM. It may be is not there yet but it looks highly appealing, is as fast as the often mentioned Rust and compiles significantly faster. http://nim-lang.org/

Nim compile times are faster and often the execution time is faster, too. Also it's very expressive, almost like Python.

Re: Getting Past C

#496

Earlier quoted context omitted.

For me, this is the gist of the article: >> But NTPsec is a lot smaller and cleaner now at 62KLOC of C (that’s just 27% of the original size). It’s been brought up to pretty tight C99/ANSI standards conformance, and the few remaining platform dependencies are either already well isolated or can easily be made so. Then they have a section about future plans and a short comparison of two possible languages. I'm surpris…

Maybe you should learn from the fact that so many people are talking about Rust.

I did. See above comments.

Re: Getting Past C

#497
post #475

Earlier quoted context omitted.

Last time I took a look at D I was awed by how terrible it's documentation is.

I very much enjoy using D and want it to succeed but this statement along with finding "everyday uses" for things (e.g. using zeromq) are huge drawbacks to buying into it. I'll still advocate but it's not easy sometimes

I think three things attribute to a programming languages success or failure: tooling, documentation and standard library. Look at Go, great out of the box library, same with Python, but the tooling for Go isn't the greatest (debugger? a real IDE? etc) then you look at C#: tooling (Visual Studio, VS Code, debugger), documentation, and even out of the box the .NET Framework is a decent "standard library" with plenty included. If only D had at the very least a well dedicated IDE. I hope more people notice D so that the community around it builds solutions, it has a lot of great potential yet to be tapped, and plenty of groundwork has already been done with D.

Re: Getting Past C

#498

Earlier quoted context omitted.

ATmega is not really a popular architecture any more. It only stuck around because of Arduino, and even that is moving towards ARM. Nobody is going to be running NTPsec on it in any case!

What arduino-class (that is, low power microcontrollers) devices are moving towards ARM? Seems like a very different use case from portable computers (like the Raspberry Pi) - the power consumption differences are pretty major. > Nobody is going to be running NTPsec on it Never say never. :) There are wifi, ethernet, and clock shields for Arduino, all of which are running microcontrollers, and many applications which…

> What arduino-class (that is, low power microcontrollers) devices are moving towards ARM?

Erm, like, all of them? ARM has a 24% market share in microcontrollers, and 70% in 32-bit microcontrollers.

Source (page 21): https://www.arm.com/zh/files/event/1_2015_ARM_Embedded_Semin...

Here are a ton of Arduino-style boards with ARM chips: https://developer.mbed.org/platforms/

Re: Getting Past C

#499

what's wrong with OpenNTPD exactly?

There's a summary of some of its limitations here: https://en.wikipedia.org/wiki/OpenNTPD#Criticism One of them (lack of leap second support) is fresh on our minds since we just had a leap second. Some thoughts from the OpenNTPD folks are at http://undeadly.org/cgi?action=article&sid=20150628132834 Chrony is another alternate NTP implementation, here's their comparison vs ntpd and openntpd. https://chrony.tuxfamily.o…

It sounds like the leap-second thing isn't that big of an issue though...

Re: Getting Past C

#500
post #27

Can anybody make a strong case to me as to why are buffer overflows considered an issue in C when it takes like 10 minutes to write and test an array implementation that prevents that from ever happening? I do agree that C has issues (though in my opinion neighter Rust nor Go address almost any of them) i just don't understand why are buffer overflows such a huge problem in C when the same thing is going to come up w…

I believe your post is the strong argument you desire aka hubris
Post reply on HN