Earlier quoted context omitted.
The term 'safe' varies a lot based on context. In this context it is being used to mean 'memory safe' - i.e. that the compiler can eliminate a class of behaviour that are the root of a number of recent security issues. "Safe" in the context of medical and aerospace means something very different, but is much closer to the meaning of "Secure" in this context. No compiler is ever going to prevent you writing insecure c…
Memory safe code is the basic requirement of of safety critical code. Btw. memory safety includes checking for stack and heap exhaustion.
Building on Rock, Not Sand
91–100 of 112 posts
Re: Building on Rock, Not Sand
#92I'm always confused by the "safe language" evangelism. Reducing cognitive load is a Good Thing TM; I get that. But aren't we just trusting the Rust compiler and JVM to not have subtle bugs that introduce memory management errors into our programs? Centralizing the memory management code to some well tested core---like the Rust compiler or some C lib---sounds to be the crux of wiring memory safe code, not the language…
Concerning Rust specifically—Rust’s memory safety comes from its type system; specifically, its strong ownership model, which leads to its lifetime model. Without these, you simply can’t have a fast, memory-safe language: either you surrender speed, by boxing everything, or you surrender safety. My point is that it’s not possible to just isolate the hazardous chunks into a well-tested core; it needs to be pervasive i…
> Without these, you simply can’t have a fast,
> memory-safe language: either you surrender
> speed, by boxing everything, or you surrender safety.
Not only can you have speed and safety without Rust's rigid enforcement of exclusive ownership, you can do even better--even faster and with even stronger security guarantees:https://www.youtube.com/watch?v=zt0OQb1DBko http://www.ats-lang.org/
Re: Building on Rock, Not Sand
#93Earlier quoted context omitted.
> On the other hand, it probably is less effort to rewrite PolarSSL in Rust than doing that proof. It's probably even less effort to convert to SaferCPlusPlus[1] (essentially a memory-safe subset of C++). There's even an tool[2] (under construction, but functional) to do a lot of the conversion for you. [1] shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus [2] https://github.com/duneroadrunner/SaferCPl…
SaferCPlusPlus is not memory safe, according to your documentation. For one thing, the "this" pointer problem is pretty much unsolvable in C++.
Well, you could just avoid/prohibit the explicit and implicit use of the "this" pointer. I.e. prohibit non-static member functions[1], right?
[1] https://github.com/duneroadrunner/SaferCPlusPlus#practical-l...
Re: Building on Rock, Not Sand
#94I'm always confused by the "safe language" evangelism. Reducing cognitive load is a Good Thing TM; I get that. But aren't we just trusting the Rust compiler and JVM to not have subtle bugs that introduce memory management errors into our programs? Centralizing the memory management code to some well tested core---like the Rust compiler or some C lib---sounds to be the crux of wiring memory safe code, not the language…
> But aren't we just trusting the Rust compiler and JVM to not have subtle bugs that introduce memory management errors into our programs? Empirically, programs written in memory-safe languages produce multiple orders of magnitude fewer memory-related bugs than C and C++ codebases do. > Centralizing the memory management code to some well tested core---like the Rust compiler or some C lib That isn't practical in C (o…
The ultimate solution to the problem is formal verification. Rust solves this for buffer overflows, but nothing else. It's a one trick pony. Someone posted this interesting nugget on HN the other day:
https://www.youtube.com/watch?v=zt0OQb1DBko
Aside from some of the awkward ergonomics, its mechanism for formal specification looks brilliant. And you get to keep C's bag-of-bytes object manipulation and pointer arithmetic (when you want it) without having to resort to unsafe{}.For projects where it's worth the effort to carefully declare precise typing semantics (because safety, performance, whatever), I want a wholistic solution. Otherwise my time and money is better spent throwing Javascript or Python at the problem, which solve the buffer overflow problem just as well.
Re: Building on Rock, Not Sand
#95Earlier quoted context omitted.
> But aren't we just trusting the Rust compiler and JVM to not have subtle bugs that introduce memory management errors into our programs? Empirically, programs written in memory-safe languages produce multiple orders of magnitude fewer memory-related bugs than C and C++ codebases do. > Centralizing the memory management code to some well tested core---like the Rust compiler or some C lib That isn't practical in C (o…
How many buffer overflows were involved in the Equifax leak? The ultimate solution to the problem is formal verification. Rust solves this for buffer overflows, but nothing else. It's a one trick pony. Someone posted this interesting nugget on HN the other day: https://www.youtube.com/watch?v=zt0OQb1DBko Aside from some of the awkward ergonomics, its mechanism for formal specification looks brilliant. And you get to…
Completely false. Rust's design prevents all memory safety problems (that's what "memory safe" means). Buffer overflows aren't even the most pernicious kinds of memory safety problems anymore. Use after free is worse, and Rust spends most of its complexity budget on preventing that.
Re: Building on Rock, Not Sand
#96Re: Building on Rock, Not Sand
#97Earlier quoted context omitted.
SaferCPlusPlus is not memory safe, according to your documentation. For one thing, the "this" pointer problem is pretty much unsolvable in C++.
> For one thing, the "this" pointer problem is pretty much unsolvable in C++. Well, you could just avoid/prohibit the explicit and implicit use of the "this" pointer. I.e. prohibit non-static member functions[1], right? [1] https://github.com/duneroadrunner/SaferCPlusPlus#practical-l...
Why not just use a language designed for memory safety (which is most of them)? It's a whole lot easier, plus you get an ecosystem of actually safe code.
Re: Building on Rock, Not Sand
#98Re: Building on Rock, Not Sand
#99Earlier quoted context omitted.
> For one thing, the "this" pointer problem is pretty much unsolvable in C++. Well, you could just avoid/prohibit the explicit and implicit use of the "this" pointer. I.e. prohibit non-static member functions[1], right? [1] https://github.com/duneroadrunner/SaferCPlusPlus#practical-l...
Does anyone actually want to program in "C++ with instance methods banned"? Why not just use a language designed for memory safety (which is most of them)? It's a whole lot easier, plus you get an ecosystem of actually safe code.
Well, passing a "safe this" pointer as the first parameter to a (static) member function isn't that hard to get used to, is it?
But I don't disagree with your gist. If memory-safety is your only concern and you're not trying to salvage an existing codebase, then Rust might be a better choice.
But if you're trying to add memory safety to, say, an existing C implementation of SSL, the SaferCPlusPlus route would probably be less effort. Even when non-static member functions are banned.
> (which is most of them)
Personally, I consider RAII (deterministic destructors) an essential feature for safe, efficient programming at scale. That leaves only two choices, C++ and Rust, right?
And if there's a memory-safe C++ option available, there are some arguments for choosing it over Rust.
Re: Building on Rock, Not Sand
#100Earlier quoted context omitted.
How many buffer overflows were involved in the Equifax leak? The ultimate solution to the problem is formal verification. Rust solves this for buffer overflows, but nothing else. It's a one trick pony. Someone posted this interesting nugget on HN the other day: https://www.youtube.com/watch?v=zt0OQb1DBko Aside from some of the awkward ergonomics, its mechanism for formal specification looks brilliant. And you get to…
> Rust solves this for buffer overflows, but nothing else. It's a one trick pony. Completely false. Rust's design prevents all memory safety problems (that's what "memory safe" means). Buffer overflows aren't even the most pernicious kinds of memory safety problems anymore. Use after free is worse, and Rust spends most of its complexity budget on preventing that.
But if you watch the video, the presenter makes a great point: Rust's borrow checker is an amazing piece of technology, but it's inaccessible to the programmer. It's an implementation detail used to provide proofs for a narrow constraint--memory safety. Imagine if Rust provided syntax and semantics which not only allowed you to effectively implement the borrow checker yourself using a more general declaration system, but implement any other kind of formal specification needed to prove the higher-level semantics of your code.
In other words, imagine if a more general formal specification system were as first-class as the ownership- and mutability-oriented syntax are in Rust; a language that unifies the annotation model of solutions like Ada SPARK and Frama-C, but which is properly integrated into the language.
And that's what ATS is exploring. As the presenter says, ATS might be ugly as a systems language (because misallocated complexity--some easy things are too complex, some complex things are too easy--increases cognitive load and reduces efficiency), but its mechanism for formal specification is brilliant. Improve ATS, or apply it's novel approach to a language designed as a daily driver, and you'd finally have a realistic answer to the plague of buggy infrastructure software.
I realize this sounds like I'm making perfect the enemy of the good here. But I stand by my point: major failures like Equifax rarely involve memory safety, per se. Arithmetic issues are far more common, and even those are on the long tail of a much larger issue; namely, an inability to [efficiently] provide verifiable specifications for higher-level semantics. We hyper focus on buffer overflows, arithmetic overflows, etc, because we understand them and we know (at least in principal) how to fix them. But those are psychological blinders that cause us to miscalculate relative risks. We tend to overestimate the cost of problems we can fix relative to the cost of problems we're unsure about how to fix.