Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor in a safer language: Network team update from Amsterdam

lists.torproject.org

Post reply on HN
Print view View original

171–180 of 254 posts

Re: Tor in a safer language: Network team update from Amsterdam

#171

Post by ilovecaching »

sfilargi wrote: post #20

As a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular. It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened.

Don't frame the question as language X vs language Y. Think about the ecosystems instead. Golang provides a batteries included API that allows developers to rely less on third party libraries with shaky SLAs, a promise of version stability, and great tooling that has increased consistency of coding styles across projects. It's a simple language with a a low barrier to entry, and the Google brand encouraged earlier adopters to take risks and build products that luckily became very popular (Docker, Kubernetes, etc). It looks a lot like the languages that are already popular in Industry, without providing any real groundbreaking concepts. Building software is an economic value proposition, and it turns out that there are many ways in which a language's ecosystem can provide good value for the investment beyond the pros/cons of the language itself, and often these advantages are easier to measure from a managerial standpoint.

Re: Tor in a safer language: Network team update from Amsterdam

#172

Post by bluejekyll »

nickpsecurity wrote: post #128
bluejekyll wrote: post #90

Earlier quoted context omitted.

> I keep thinking a different language that acts as a front end w/ a better syntax might be a good idea... Also, a seemless FFI for C libraries like Julia's. You mean Rust I think ;)

People have had a hard time learning Rust. I also get gripes about its inconsistency in language syntax. The FFI I hear is good. It certainly doesn't output to SPARK or a C subset designed for easy, static analysis. So, Rust ain't the Ada makeover Im thinking about. It's also in a stability-oriented freeze of existing design right now. So, the makeover will need to be a different language.

> People have had a hard time learning Rust.

I won't lie to you. It took me longer to produce good code in Rust than almost any other language I've recently learned. But it's worth it; it's quite simply amazing that it is capable of guaranteeing what it does, with nearly zero overhead. Also, I'd say in many ways it's simpler than C, because it has no undefined behavior; I don't need to concern myself with any of the nuances that I had to learn in C. I highly encourage you to give it two weeks, that's what it took me to become hooked.

Re: Tor in a safer language: Network team update from Amsterdam

#173

Post by Tempest1981 »

seibelj wrote: post #132
Tempest1981 wrote: post #81

Earlier quoted context omitted.

We use OpenDNS for safer kid surfing and logging. Can I get similar functionality? Your FAQ says you use "Private Internet Access’ custom DNS servers". Also, what about the Netflix issue?

You cannot use Netflix with any non-self-hosted VPN service, they have put a lot of effort into getting around it. We use PIA's DNS for anonymity.

So do you have a workaround? Can you bypass VPN routing for Netflix and other specific domains?

Re: Tor in a safer language: Network team update from Amsterdam

#174

Post by steveklabnik »

dguido wrote: post #169

Literally none of this matters. None of the flaws exploited in Tor are memory corruption flaws. They are entirely architectural and design flaws. No attacker cares if they move to Rust. _NO ONE_.

> None of the flaws exploited in Tor are memory corruption flaws.

http://www.cvedetails.com/product/5516/TOR-TOR.html?vendor_i...

This list is full of memory safety issues.

Re: Tor in a safer language: Network team update from Amsterdam

#175

Post by pjmlp »

stepik777 wrote: post #139
pjmlp wrote: post #88

Earlier quoted context omitted.

I never understood the idea behind cgo instead of having a proper FFI like Delphi, .NET, Eiffel and so many other languages.

That's probably because of coroutines.

The runtime could take care of that, just like it happens in another languages.

Re: Tor in a safer language: Network team update from Amsterdam

#176

Post by pjmlp »

SamWhited wrote: post #164
pjmlp wrote: post #86

Earlier quoted context omitted.

Without support for meta-classes, annotations, generators, iterators and list comprehensions it surely is worse.

Unless you're one of the people (like me) who considers its lack of many of those things a feature. More features doesn't necessarily make something "better" and less features doesn't necessarily make it "worse" (whatever your definition of "better" or "worse").

No I am not, I am no longer programming in the mid-90's and even on those days, Turbo Pascal had more features than Go.

I only advocate Go as a replacement for those that would use C for user space applications, or possibly some kind of low level stuff.

If Python and Ruby eco-systems had blessed compilers, instead of just CPython and MRI, I doubt people would be flocking to Go.

We already see this happening in the Ruby world, just let Crystal become a bit more mature.

Re: Tor in a safer language: Network team update from Amsterdam

#177

Post by pjmlp »

geodel wrote: post #141
pjmlp wrote: post #85

Earlier quoted context omitted.

No, Java has become too advanced for the typical Go developer. Too many features.

It is for me. Could not figure out advanced tools like Maven or gradle. Maybe it was beneath Java experts at Sun/Oracle develop simple cli tool that could compile a java project with one command.

You mean just using javac -sourcepath is too hard?

Re: Tor in a safer language: Network team update from Amsterdam

#178

Post by dullgiulio »

vertex-four wrote: post #120
JepZ wrote: post #102

Earlier quoted context omitted.

I am afraid Rust will become much more popular than Go is atm. I think the C++ crowd will embrace it as soon as it will be mature. I am sure it is better than C++, but I still like the concepts and syntax of Go much better. But as C++ programmers obviously never care about readability and simplicity, I am pretty sure they will take Rust. After all, Rust is a decent language and as users, we will all benefit from the…

I've... never had a problem reading Rust code. It's generally well-typed, and makes good use of "automatic" error handling constructs to ensure errors flow upwards without visually polluting the success case. Whereas with Go code, I have to filter out all the error handling (which often takes up 2/3rds of lines of code, even when it's just "if there's an error, return the error" which it almost always is), wade throu…

You are not handling the error, you are just returning it.

More correctly, you would decorate the error:

    foo, err := bar()
    if err != nil {
        return nil, fmt.Errorf("failed to do bar: %s", err)
    }

Re: Tor in a safer language: Network team update from Amsterdam

#179

Post by microtonal »

SamWhited wrote: post #163
bwanab wrote: post #96

Earlier quoted context omitted.

Seems weird that from what I hear about the intense interview process that Google programmers go through that they'd feel a need to dumb down the language of choice.

No matter how smart you are (or think you are), or how much state you can store in your head at once, if you remove some of the mental overhead of a language, then you have more time to think about other things. It's not about people needing to "dumb down" anything, it's about having a bit less mental overhead, meaning you can get a bit more done a bit easier.

No matter how smart you are (or think you are), or how much state you can store in your head at once, if you remove some of the mental overhead of a language, then you have more time to think about other things.

So you use a language that makes specifying ownership (and immutability hard)? I always feel Go adds a lot of mental overhead.

E.g., if you have a method that returns, say, a float32 slice. 1. If I return a slice of an array/slice that is a struct member, the caller could modify elements in the slice, breaking struct invariants. 2. Returning a copy of the slice is safe, but adds a lot of overhead. What you'd actually want is to return an immutable slice, but Go does not provide any facilities to do so (apart from wrapping a slice, but the lack of generics and operator overloading makes this tedious).

I guess a lot of Go code will just assume that returned pointers/slices/maps will not be used in a way that breaks invariants. But you usually end up reading the source code of 3rd party packages to see what is safe, whereas in other languages you could just read the method signature.

tl;dr: I think ownership and preserving invariants usually give the most mental overhead and Go does zero in that department.

Re: Tor in a safer language: Network team update from Amsterdam

#180

Post by m-j-fox »

m-j-fox wrote: post #5

I don't know much about Tor. But I hope I can route all of my home network traffic through it. That or route everything through VPN. I'll bet you can guess why I'm suddenly interested.

Curious why this is one of my most hated comments in at-least a couple days ...
Post reply on HN