It's time to halt starting any new projects in C/C++

And then the commander goes all in on that strategy, enemies knock out communication networks / find a drone counter measure, and now enemies have a decided advantages because they kept bayonets on their machine guns.

> I really like C. I did actually spend about an hour reading his code. It's very nice, and I genuinely believe that Gavin is probably capable of writing memory-safe C most of the time.

This is a nice compliment, thank you.

> Except when his sanitizer setup is accidentally disabled, of course.

Fair criticism. XD

> I did find at least one case where a function in isolation is explicitly not memory-safe, but its safety depends on implicit and undocumented assumptions about how it's called. I didn't find a way to exploit it from the userland program. In `bc_parse_addNum`[1], a `char` pointer string is indexed into without checking the length. Callers are expected to provide strings of at least length 2. That expectation is not documented, though it is adhered to. But it is a landmine waiting to be tripped over should that assumption change.

Callers are actually required to pass a string of length 1 including the nul terminator, but you are correct, this assumption is not documented in `bc_parse_addNum()`, and it should be.

By the way, `bc_parse_zero` and bc_parse_one` are constants, so I can make assumptions about them. This is why an empty string is fine: those constants do not have nul terminators at index 0, so if the string parameter does, the short-circuit operators will short-circuit.

I've pushed commit e4b31620f181 to document that assumption, along with a note that assuming a non-empty string might be useful too.

> But this is a sideshow. Experts have been insisting for decades that they can write crash-free C and yet we continue to regularly find exploitable memory issues in every large multi-author C project. It's plain as day that—for almost all of us—an increasingly indefensible amount of the time spent on C programs is in dealing with the types of bugs that languages like Rust prevent outright. Whether that's simply finding and fixing them, architecting programs to avoid them, incorporating those fixes into downstream projects, mitigating their impact in live production systems, or whatever, our industry pays an enormous ongoing cost. Even in projects that have never had a public release with a memory bug, significant engineering time is spent on them just during development iteration.

I agree with this. I never said people should use C by default; absolutely not. They should use Rust by default.

But as I said in another of my comments [1], I think I personally would write buggier code in Rust than in C.

[1]: https://news.ycombinator.com/item?id=32915468

> I'm sorry, but this is an entirely imagined persecution. Nobody is taking your C compiler away from you. Nobody thinks you're a bad person for using C. Nobody thinks you're a bad programmer for using C.

I've had people say all of these things to me in various ways.

"You should be ashamed of yourself," is a typical phrase used.

> Many of us think there are better alternatives. We're excited about these better alternatives. We want people to use these better alternatives. We think these better alternative solve a lot of problems that many people spend a lot of time dealing with. We think these better alternatives prevent many of the types of bugs that regularly ruin people's afternoons, evenings, and weekends.

This excitement has been over-the-top and as mentioned by one or more people in this thread, it has actually driven people away from Rust. As much as I don't like Rust, I don't want that to happen.

> We really think you should try it out, but if you don't like it, literally nobody is coming to take your compiler away from you.

When people say they want to deprecate C, that's what they mean. If you deprecate C, the compilers will be abandoned, which in the software world converges to the same effect as taking it away because compilers need ongoing maintenance to keep up with new platforms and such.

If a new platform becomes mainstream, and there's no C compiler for it, then my C compiler has effectively been taken away.

This is one reason I'm making my C replacement language: I do think that C will eventually be abandoned on the major platforms, and I want to have switched by that time.

> We do think a lot of the common arguments against moving to these languages are bull** though.

Which is fair. You didn't say all of them are, and yes, a lot of the common arguments are crud.

> "Rust can't do self-referential data structures" is one of them.

I actually agree with you; this is a crud argument. In order to make my C as safe as possible, I don't use self-referential data structures either; I use a parent data structure.

I did this with linked lists [1]. The linked list is a parent data structure that owns everything, and the items in the linked list just have indices to their neighbors. This allows me to tie Rust-like lifetimes to the items.

And any self-referential data structure can be expressed in terms of a parent data structure and children data structures.

So yes, you are right: this argument is crud.

> "I have a ton of expertise in C and it would take more time than I'm willing to spend to get to that level in something else", "this project is already written in C and mature", and "I write code for unsupported platforms" aren't bull**, but they are ones that naturally decay in how compelling they are over time.

I agree. This is another reason I'm still writing a C replacement for myself.

> And as much as I believe you personally can write memory-safe programs in C, I would be willing to bet this guarantee would go out the window the moment you add a second maintainer who can push and release code without you vetting every commit.

Yep. I agree. Even if it's Linus Torvalds, Ken Thompson, or anyone.

I still vet every commit, or just not accept anything.

It also helps me keep the scope manageable: if I can't do it myself, the scope is too large.

[1]: https://git.yzena.com/Yzena/Yc/src/branch/master/src/contain...

If we're talking about raw performance then I'm baffled at what you're talking about to begin with. Rust can link with assembly just as well as c++ and I believe inline asm was stabilized a while ago. Otherwise it's llvm doing the heavy lifting on optimization so clang++ or rust is not much different.

Other than the fact that rust can rely on much much stricter aliasing rules and do a bit better on some optimizations because of it.

Usually when people talk about rust getting in their way they mean the borrow checker, which you can ask to get out of your way and it will still prevent bugs around the unsafe code. Bugs that "advanced programmers" are also prone to, especially around concurrency.

The idea that some programmers are so good they don't make simple but consequential mistakes in code that deals in concurrency and memory management is absolutely elitism.

There is no programmer on the planet who can't benefit from the borrow checker, and if there are any who will benefit less than they are "hindered" by it, there are almost certainly vanishingly few.

Don't you have that the wrong way round? In this tweet, Russinovich is arguing for the newer thing, not the older thing. The comparison would be the commander saying use a machine gun and consider bayonets obsolete, and the commenters who haven't used a machine gun are saying "he hasn't enough experience with modern bayonetting to say that, modern bayonettes wielded by sufficiently competent bayonetters are as good as any machine gun".

And then other critics saying "Russinovich hasn't demonstrated skill with a machine gun so how can he say bayonettes are obsolete?"