Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor in a safer language: Network team update from Amsterdam

lists.torproject.org

Post reply on HN
Print view View original

31–40 of 254 posts

Re: Tor in a safer language: Network team update from Amsterdam

#31

Post by ASinclair »

sfilargi wrote: post #20

As a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular. It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened.

> As a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular.

You can pick it up in a weekend. A lower entry bar means more people will try it out.

> It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened.

It was developed in a large enterprise context not in an academic context. I think it shows.

Re: Tor in a safer language: Network team update from Amsterdam

#34

Post by steveklabnik »

masklinn wrote: post #10
bitexploder wrote: post #3

I am curious why they were advised not to use Go. Probably not a safety concern. Edit: cgo != Go. Thanks for the responses. I have done a bit of Go, but just pure Go.

They were not advised against Go but against cgo. Part of what they want is incremental conversion and cgo is at the same time not-go[0], costly[1] and complex[2], and then you still need to manage the Go runtime (GC & al) from within your C system. That makes integrating the two difficult, especially when you want to replace the existing system piecemeal. A pure-Go rewrite might be an option (in fact Tor seems prett…

go -> C calls have gotten way way cheaper in newer versions of Go. There's still overhead but it's not as bad as it used to be.

Re: Tor in a safer language: Network team update from Amsterdam

#35

Post by ue_ »

ASinclair wrote: post #31
sfilargi wrote: post #20

As a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular. It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened.

> As a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular. You can pick it up in a weekend. A lower entry bar means more people will try it out. > It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened. It was developed in a large en…

To be honest, you can probably also pick up Lisp in a weekend, experienced programmer or not. The syntax is also simpler.

Re: Tor in a safer language: Network team update from Amsterdam

#36

Post by fjdlwlv »

sfilargi wrote: post #20

As a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular. It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened.

Go is a genersl purpose industry language. The ones you mention are niche or academic research languages.

Re: Tor in a safer language: Network team update from Amsterdam

#37

Post by akerro »

sfilargi wrote: post #20

As a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular. It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened.

Wow, have you seen JavaSCript?

Re: Tor in a safer language: Network team update from Amsterdam

#38

Post by sfilargi »

fjdlwlv wrote: post #36
sfilargi wrote: post #20

As a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular. It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened.

Go is a genersl purpose industry language. The ones you mention are niche or academic research languages.

I just put some names randomly. You can add C++, Python, Ruby, and pretty much any other language after C.

Re: Tor in a safer language: Network team update from Amsterdam

#39

Post by nickpsecurity »

geofft wrote: post #27
nickpsecurity wrote: post #15

Since bitexploder asked, I'll add what I wrote on this on other forums. If it's about secrets or anonymity, make sure you always use a safe language that supports careful control and reasoning about both memory and CPU time. The reason is that this enables covert, channel analysis for vulnerabilities that leak secrets through storage and timing. It's why I wanted Freenet to ditch Java aside from the obvious reasons.…

You can use some analysis tools on Rust code, because it generates C-ABI-compatible objects; for instance, I'd expect that https://github.com/agl/ctgrind would work on Rust. Looking at the MISRA-C guidelines (or more specifically, a pirated copy - are these available legitimately to the public?), it seems like about half of them aren't problems in Rust, because it's warning you about stupid things in C that can't be…

I said MISRA-C combined with tooling. Many of the best tools using very, diverse methods start from a safer subset of C (eg MISRA-C) or need C itself. Such tools would have to be rewritten for use with Rust. Difficulty of that varies per tool but it's not happening for most right now.

Re: Tor in a safer language: Network team update from Amsterdam

#40

Post by danieka »

steveklabnik wrote: post #32
danieka wrote: post #29

Earlier quoted context omitted.

How so? I'm honestly wondering why.

Today is April Fool's Day.

Oh. So I get it is a joke, I just don't get why it is a joke. I program daily in Go and everytime I read about buffer overflows and a dozen other preventable security holes I'm glad I'm programming in Go.

But maybe this joke is only funny to those who enjoy programming in C? :)

Post reply on HN