Live data from Hacker News

It's time to halt starting any new projects in C/C++

twitter.com

831–840 of 929 posts

Re: It's time to halt starting any new projects in C/C++

#831

Earlier quoted context omitted.

"I don't understand why people want multiple compilers." Most people don't. But most development moved away from C/C++ before rust. If you want to call C & C++ "deprecated" you can't ignore the margins, which is exactly where those languages thrive. Maybe there needs to be a tiny (incomplete?) rust compiler. Or maybe there should be an interpreter.

> Maybe there needs to be a tiny (incomplete?) rust compiler. Or maybe there should be an interpreter. In which case the issue is "Rust doesn't have a small compiler" or "Rust doesn't have an interpreter". Having multiple compilers won't necessarily mean that those issues are resolved. A more generic argument would be something like "the existing compiler doesn't cover my use cases".

So then when program X misbehaves on one compiler and not the other, is it a program bug or a compiler bug?

Typically this would be resolved with a language standard.

Re: It's time to halt starting any new projects in C/C++

#832

Earlier quoted context omitted.

To what end? You’ve already stated elsewhere that your only point is that you can, under an increasingly strict set of conditions, write code that is (almost always) free of memory bugs. Great! Nobody is hiding around the corner waiting to take `gcc` or `clang` away from you if you want to keep using them. Nobody's threatening to take away your software engineering license if we catch you writing a memory bug. This w…

The RESF seems to want to take C away from me. They seem to think I am a bad person for using C. They seem to think I am a bad programmer for using C. To refute all of that, I point people at some code that they would probably struggle to break.

Lest you lump me in with the RESF, I just want to make it clear that all I did was point out your overconfidence in your C abilities. I don't care what language you use or anyone uses. I think Rust has lots of problems that it's stuck with, and I've said on multiple other occasions that the ideal language would be a mix of Rust (borrow checker, typesystem) and Zig (comptime, generics, explicit allocation).

Re: It's time to halt starting any new projects in C/C++

#833
post #813
post #645

Earlier quoted context omitted.

> They mostly need stability and cross-platform support But Qt provides that… tauri has exactly 1 release, that was done 4 days ago. sciter has done no release in over a year, and has 6 releases total. It would be completely insane to pick either of those instead of Qt.

Fighting the problems of Qt bindings, Qt, Qt's build system to me is just not worth it. If someone is a Qt and C++ expert, then maybe, but it still seems like an uphill battle compared to web stuff, which to me seems better supported on all platforms.

If you can use webstuff, clearly it wasn't a problem that involved c++ or rust in any way.

Re: It's time to halt starting any new projects in C/C++

#834

Earlier quoted context omitted.

> I’m sorry that people have implied that, but I feel most of the time when Rust people say languages like C should be retired or deprecated, are doing so because your skill and attention to detail does not scale. This is a fair argument. On the other hand, I wish we had less software so that attention to detail did not need to scale. For example, I run a Gentoo machine with the Awesome Window Manager and no systemd.…

> This industry grew too fast for its own good. It would have been better if it had had a master and apprentice model. The best programmers would be "masters" (in the sense of master and apprentice), and juniors would be apprentices who would write code under the master until the master thought them good enough to be journeymen (moving up from junior), and over time, such journeymen would themselves come to be recogn…

> I 1,000% agree with this perspective. I also actually suspect that some form of professional licensing and/or personal liability would benefit the industry greatly, in that it would give more power to engineers to decline to build software irresponsibly due to pressure from management.

I also 1,000% agree with this. In fact, if there is any activism I do within the industry, it's pushing for this.

> Obviously this would be wildly complicated and there would be (potentially intolerable) downsides, but I do wonder what things would look like if we could revoke the licenses of people who repeatedly exercise poor judgment, or if responsible engineers knew they had the backing of a professional organization when pushing back against management.

I don't think there would be any downside other than expensive software. But studies have shown that poor software is more expensive!

The one thing that would complicate it is Open Source, but I think that hobbyists should be allowed to practice and put code up with no vetting, just like an engineer might design a shed for his backyard and post it on a blog without his/her seal of approval.

However, if some company decides to use that shed/Open Source code in a project, that company's certified engineers/programmers should be required to vet it the same as they would do for their own code.

And as for the gatekeeping of certification, I think uncertified programmers should be allowed to program, but under the supervision of a certified programmer who accepts liability for their work because that chief programmer should be checking their work.

> The irony isn't lost on me that elsewhere in this thread I said that nobody is coming after your software engineering license if you keep writing C :)

Maybe a litte irony, but I would probably be harsher on myself than you would think.

I think there would probably be a certification for writing C, one for writing Rust, etc.

So I would not be allowed to program as a certified engineer for Rust, but I could probably be certified in C, even though the certification and standard of care for C would be much harder and have a higher bar, for obvious reasons.

I don't know what the industry would set the standard of care for C at, but I personally wouldn't set it lower than my personal standards. If it was set at that, then my license should not be taken away, even if I were paid to work on `bc`.

But if it was set higher, say at the level given to libcurl or SQLite, then yes, I should lose my license if I were working for pay on `bc`, unless I stepped up.

In addition, if I worked on `bc` for pay, my failure to prevent memory bugs in `bcl` recently (the one where Valgrind was not hooked into its tests properly) should, at the very least, put me in front of a licensure board to explain myself. My recent failure to prevent the double-free on `SIGINT` when running expressions should also put me in front of a licensure board to explain myself.

If any paying user had been caused trouble for those bugs (no one ran into them as far as I know), I should have to compensate them for the trouble and probably lose my license for negligence. I was extremely upset that I let those slip through.

So no, I shouldn't lose my license for using C, but there should be one for C, and I should have at least come close to losing it for the recent mistakes that I would consider near-negligence.

> And I do realize that would probably be a disastrous idea in practice. But in my mind it's great.

I want to hear why it might be a disastrous idea. I can't see how it would be because it would lead to less but better quality software, and if bad software actually costs more in the long run, it would actually save the industry money! So I fail to see how it would be disastrous.

Please enlighten me on this; I have to know the weaknesses.

> And while I do agree that the industry grew too fast for its own good, this is unfortunately the reality we live in. The need for software has exceeded both our ability to produce it reliably and our capacity for training qualified engineers. So we have countless junior developers writing production code without good mentors.

Yes, this is the reality. This is why I don't dismiss Rust even though I hate it.

> And worse, I think we also have a terrifying number of "senior" engineers who are actually junior engineers with a lot of experience but trapped in a local maximum.

I really don't want you to be right, but I think you are, and that terrifies me because something bad is going to happen. I don't know how we fix this.

However, the end result of that bad thing might actually be certification and standard of care, which wouldn't be a bad thing.

As they say, regulations are written in blood, and I think that's the only way to fix this.

It's just too bad that people will have to die before that happens. I mean, I thought the Boeing 737 MAX would be the wake-up call, but it wasn't. Sigh...

> I "get" async/await but I… hate that it has to exist. I avoid it in all of my Rust projects. Partly because I don't want to use it, but also because I've never needed to solve a problem in a domain where it would have been invaluable. So just so you know, I've been writing Rust since right around 1.0 and I've been essentially able to just pretend it doesn't exist. I've never used it, but also I've never had to think about not using it if that makes sense.

That makes a lot of sense, and I don't blame you.

It's too bad we had a misunderstanding at the beginning of our conversations about this because I think we would agree more than disagree on the direction the industry would go. Oh well; we got to a point where we cleared up the misunderstanding.

Thank you.

Re: It's time to halt starting any new projects in C/C++

#835

Earlier quoted context omitted.

By structuring the language around RAII and structured concurrency. More details in my great-great-great-great-grandparent post. [1] tl;dr: If threads never exit before their descendants, and you only borrow an item in callees and in descendant threads, that would negate the need for a borrow a checker. As for sharing an item across threads and still not having data races, this will be done by implementing something…

Ah, sorry, my bad, I should have read the whole thread in detail first instead of just skimming it. (: So do you also intend to completely disallow mutation? Because that's the only way I could see this matching Rust's safety guarantees without actually having a borrow checker. Say, for example, that you allocate a new string, and you take a reference to it, and then you append to that string within the same scope. T…

Mutation will be disallowed in general, yes. It's a bit more subtle than that, but you get the gist.

In my language, there are strings, which are fixed size and cannot be reallocated, and string builders, which hide the actual string behind another layer of indirection to avoid the problem with mutation.

That sort of pattern would be used as necessary to avoid the problems with mutation in the same thread. And Send/Sync would take care of the rest across threads.

Re: It's time to halt starting any new projects in C/C++

#836

Earlier quoted context omitted.

ABI shenanigans are what killed the whole "off-the-shelf components" promise of C++ and object orientation. They really made the same mistake again?

I don't know how you arrived at that. C++ has the exact opposite ABI problems: it has a far-too-stable ABI that leaks thanks to poor abstractions (header files and template expansion in first-party code). Institutional C++ users have far too many implicit ABI dependencies to ever sign off on breakages, so C++ stdlib maintainers are unable to optimize much of the `std` namespace. This in contrast to Rust, which actual…

I arrived at that through the entire C++/OO/pre-built-components hype of '90s and beyond, the failure of which was blamed on a non-codified ABI.

Re: It's time to halt starting any new projects in C/C++

#837

Earlier quoted context omitted.

> Ah, of course. I knew that they were constants, but I didn't consider the short-circuiting of the comparison before indexing further into the string. No worries! That's why I specifically wrote it that way instead of a `strcmp()` call. I may be a little obsessive over getting my code right. > I hope you understand that—all snark aside—I truly, genuinely believe you. Thank you. > I do suspect that if you had investe…

> But I've spent gobs of time trying to understand async/await and failed. It wasn't as much time as I spent honing my C, but it was a lot. And I did not seem to make progress. I've said this elsewhere but as a long-time Rust user I have literally never used or even encountered async/await. It exists, and I could use it if I needed to, but I never have nor have I had to spend effort avoiding it or thinking about it.…

I'm glad you said this because my impression of Rust async/await until now was that it was unavoidable, mostly because I heard that all of the big-name crates, the ones you would use in just about every project, use async/await.

Re: It's time to halt starting any new projects in C/C++

#839

Earlier quoted context omitted.

Irrelevant. All the old, problematic approaches are still valid code , and hence from a security perspective they are vulnerabilities. Whether or not you, personally, trigger those vulnerabilities or not doesn't matter: the stack is vulnerable. Note that you might choose to forbid anything that doesn't count as "modern C++", e.g. by enforced linting. Equivalently, you could instead have your compiler reject such prog…

> All the old, problematic approaches are still valid code, and hence from a security perspective they are vulnerabilities. So, you would mandate using Rust without "unsafe", then? Good luck with that.

Perfect is the enemy of good. If you can avoid "unsafe", then yes: forbid it. If you can't, then permit it for only those modules which need it; and have them expose a safer API, for use by the rest of the safe-subset-of-Rust system.

Re: It's time to halt starting any new projects in C/C++

#840
post #732

Earlier quoted context omitted.

"Modern C++" versus "older-style C++" is a meaningless, hand-wavey distinction: if your toolchain accepts "older-style C++" then you're using a vulnerable language; if your toolchain rejects "older-style C++" (e.g. using lint rules) then you're not programming in C++, you're using a safer language which just-so-happens to be a subset of C++. That doesn't affect how vulnerable the C++ language is.

If you're not using every possible construct in unsafe rust blocks, then you're not using rust - just a safer language that just-so-happens to be a subset of rust. The difference is that "discouragement" is in the compiler itself not external lint tools (though many of those "lint tools" are just optional arguments to the compiler). The big difference is the general community having less of a spread of opinions on wh…

> If you're not using every possible construct in unsafe rust blocks, then you're not using rust - just a safer language that just-so-happens to be a subset of rust.

You seem to have misunderstood my point. Whether or not you (or I) happen to be using this or feature of a language is irrelevant; the question is whether it's valid input to the toolchain.

For comparison, the existence of an SQL injection vulnerability in example.com has nothing to do with whether you or I happen to exploit that vulnerability or not.

W.r.t. Rust: the mere existence of "safe" and "unsafe" subsets, which (a) can be explicitly permitted or forbidden, and (b) are well-defined and don't differ from person to person, org to org, etc. makes it much more practical to forbid "unsafe" from as much of our code as possible, and to pin-down precisely those locations where it has been used. The same cannot be said for e.g. "modern C++"

Post reply on HN