Live data from Hacker News

Memory Safe Languages in Android 13

security.googleblog.com

601–606 of 606 posts

Re: Memory Safe Languages in Android 13

#601

Earlier quoted context omitted.

There's been many, for example Ada/SPARK, D, Nim, Java, Kotlin, Swift.

- Ada: good example, has substantial uses in certain areas. However, certain things are quite difficult, e.g. compile-time checked pointers (a la Rust's borrow-checked references). - D, Nim: neither provide strong memory safety guarantees. D has a safe subset, but it's not default (see https://news.ycombinator.com/item?id=12391720 ). Nim allows you to turn checks off at runtime. Both Nim and D generally use a GC. - J…

The fact that you originally didn’t know that Ada is heavily used in embedded clearly shows you don’t know it. Even though you edited your reply, any reader should seriously doubt your claim that “certain things are quite difficult” in Ada. Do you know that in Ada, you don’t have to use pointers or heap memory nearly as much as other languages such as C and C++? You can even write programs that don’t even use any. That avoids a whole class of issues.

One of the extra advantages with Ada is that you can decide to utilize the SPARK variant and do formal proofs on software components that are more critical. I invite you and and others to watch the presentation by Altrans where they talk about 30+ years of SPARK usage to help develop ultra low defect software: https://youtu.be/VKPmBWTxW6M

Re: Memory Safe Languages in Android 13

#602

Earlier quoted context omitted.

> all of us make mistakes and will keep making them, in any language .. unless said language makes making those mistakes difficult or impossible. Sanitizing input for example has not been an issue for me for decades, as every framework I used handles that by default, I'd have to work extra hard to make a mistake there. > Google problems are not everyone's problems. In this case they are. Not only memory safety is an…

> unless said language makes making those mistakes difficult or impossible You're missing the point [1] (or I was unclear) Yes, improvements in neuro surgery can save lives, but the bulk of preventable deaths it's in human mistakes [2] that are almost impossible to make impossible. Just like the majority of the bugs are not prevented using rust, just a minority of them, which are also arguably the hardest to find and…

> Just like the majority of the bugs are not prevented using rust,

"For more than a decade, memory safety vulnerabilities have consistently represented more than 65% of vulnerabilities". That's not minority. We are getting into minority territory now because of Rust and other memory-safe languages.

> while a SQL injection can be exploid by a script kiddie with average IQ.

Use any framework and it's solved problem.

Re: Memory Safe Languages in Android 13

#603
post #104

I am not a Rust or C++ fanboy, and I am happy that we are moving towards a future where there are less memory bugs, but… are we really? - https://www.infoq.com/news/2021/11/rudra-rust-safety/ - https://cve.report/vendor/rust-lang And you can find online similar links and research on the topic. All it takes is that you use that specific piece of code at the wrong time, and that’s it: your system which you once believe…

Every single time you (or anyone else) points to the number of CVEs as a metric, you're contributing to the computing world being less safe because you're incentivizing people to file fewer CVEs.

https://en.wikipedia.org/wiki/Goodhart's_law

Re: Memory Safe Languages in Android 13

#604

Earlier quoted context omitted.

I don't disbelieve this fact; I'd just like to see a sample program that demonstrates it.

$ swiftc - import Dispatch var array = [Int]() DispatchQueue.global().async { while true { array.append(Int.random(in: .min...(.max))) } } DispatchQueue.global().async { while true { let range = 0..

Thanks!

Re: Memory Safe Languages in Android 13

#605

Earlier quoted context omitted.

There is since that's what you declared. impl Foo { // static fn foo() {} } impl Foo { // instance, owned fn foo(self) {} } impl Foo { // instance, borrowed fn foo(&self) {} } impl Foo { // instance, boxed fn foo(self: Box ) {} } impl Foo { // instance, refcounted fn foo(self: Rc ) {} }

Again, what if there is no static declaration? impl Foo { // static fn foo() {} } Why would I need to use self to tell the compiler about an instance method? Surely the Rust compiler is smart enough to detect this case and complain if the call site is ambiguous.

> Again, what if there is no static declaration?

So your suggestion is to remove static methods from the language?

> Why would I need to use self to tell the compiler about an instance method? Surely the Rust compiler is smart enough to detect this case and complain if the call site is ambiguous.

Detect what case? There is a dozen and eventually an infinite number of potential instance call ABIs.

And the Rust compiler is generally very much on the “refuse to guess” side of the fence (hence no global type inference), so you have to tell it what it should expect, `self`, `&mut self`, and `&self` have rather different requirements, impacts, and capabilities to say nothing of the rest.

Re: Memory Safe Languages in Android 13

#606

Earlier quoted context omitted.

It’s not very useful to talk about the memory safety of languages as a whole without looking at specific implementations. JavaScript in a browser is memory safe. JavaScript with access to /proc/mem is no longer memory safe. C on most hardware is not memory safe. C running on the abstract machine itself can be.

This looks like a comment in response to https://news.ycombinator.com/item?id=33820918 and not to me. The high level idea of my original rebuke was this idea that Rust was somehow lesser because it isn't "entirely" memory safe, and that its purpose was to divide safe from unsafe. But that really misses some very big points, because the programming language implementations used to build programs virtually everywhere a…

I should probably preface this comment by mentioning that I don't think there is anything new in it for either of us. Nor do I think we actually disagree on any of the facts. My earlier comment, and this one, was really just a response predicated on what I think the colloquial meaning of "memory safety" is, and to whether a practical language can be "truly memory safe"…which of course depends on what you see a programming language as being.

Memory safety is, as you have already mentioned, not black and white: I wouldn't even put it on an axis, because that suggests the scale is one-dimensional, and I don't even think it is practical to discuss it in that context. I prefer to categorize languages (for a definition of "language") in a couple of rough groups where most of them hang out.

In the first group is C and C++ as you're typically used to it, where pretty much every operation can do something unsafe and there's really no safe subset of the language, much less safety by default.

The second group is the "safe by default" languages like Rust or Python or Java, were you can write functional programs in the entirely safe subset (which is usually the default). This is where things get more complicated, though, because what the unsafe bits look like differ. Some give you language-level constructs to do unsafe things, such as Rust (with unsafe) and Java (with sun.misc.Unsafe or whatever). I think CPython technically also falls here because of some weird implementation choices where you can corrupt memory, but it's really more of being in the other category where you can do unsafe things via FFI and external interfaces. That's kind of where most Lua implementations live, or nodejs stuff.

Then you have the things which (usually intentionally) do not give you any of these things. That's JavaScript or WebAssembly in a browser. The final stop in this line is where you start placing significant limits to what the language itself can do, such as eBPF running in the kernel, or domain-specific parsers like WUFFS.

I've been pretty sloppy with what I call a "language" here, because you can always take a programming language and slap memory safety on it: though not trivial, you can sandbox it, pick some subsets of it, put in hardware, etc. (FWIW CHERI doesn't actually make C/C++ completely memory safe, it just helps.) And going the other way is pretty easy, you just add features to let programs mess with the execution environment.

I get that the comment that you're replying to is trying to well acktually you and I agree with the rest of your response, but the takeaway I have here is "you [the commenter you were responding to originally are coming in with a definition of memory safety, yes in this context Rust does have these escape hatches and this is what they do, but in vernacular it is safe because this is how we typically evaluate languages for this sort of thing". Which, again, is like 90% of what you wrote already, I just think that it is probably worth bringing up that there is a pretty common environment for a popular language that actually takes things a step further than this, with whatever tradeoffs that entails. Not really a disagreement, just a "hey I think this is worth mentioning".

Post reply on HN