Live data from Hacker News

Fil-C: Garbage In, Memory Safety Out [video]

youtube.com

181–190 of 190 posts

Re: Fil-C: Garbage In, Memory Safety Out [video]

#181
post #141

Earlier quoted context omitted.

I was under the impression that fil-c's memory management (gc?) wouldn't work on a kernel? Be sweet if you could, ofc

This is a myth that seems to never die. OS kernels can and have been written in GC languages. Watch the video maybe? The whole presentation was running on a distro fully compiled with FillC.

The video has a slide which says,

> I'm running on an OS where the entire userland is compiled with Fil-C/C++

(emphasis mine)

Looking up https://fil-c.org/pizlix , that says,

> The kernel is compiled with Yolo-C. So that you can compile the kernel, a copy of GCC is installed in /yolo/bin/gcc.

Where do you see anything saying the Linux (the kernel) can be built with Fil-C?

Re: Fil-C: Garbage In, Memory Safety Out [video]

#182

I was amazed by the presentation all the way up until 33:47, where the buggy program compiles and only errors out when the invalid access is executed. So apparently Fil-C enforces memory safety dynamically at run-time , rather than detecting these bugs at compile-time . A new language designed around memory safety, such as Rust, can reject large and important classes of memory-safety bugs at compile-time. Rust does n…

I thought it was very obvious throughout the video what was happening... Rust has compile time checks to enforce some safety. In comparison Fil-C is a lot more memory safe, it's more comparable to being a software implementation of CHERI. Unfortunately it comes with downsides: runtime performance, runtime enforcement, granular safety (the safety is around allocations). It also comes with huge upsides: you can run C/C…

The main advantage of Rust is that you can rewrite GPL software and replace the license with MIT.

Re: Fil-C: Garbage In, Memory Safety Out [video]

#183

Who is the author of this project? Is it a single person? A small team? A single person with LLMs?

Filip mentioned in the talk that Fil-C is his personal project.

I am asking, because I doubt a single person can achieve this. It requires at least a team of several people.

Re: Fil-C: Garbage In, Memory Safety Out [video]

#184

Earlier quoted context omitted.

Every one of these posts is the same. There's this weird blindness to the problems and imperfections in Fil-C --- just shouting down. It reduces my confidence in Fil-C as a whole. Rust, for all its faults, at least engages with its critics. I've long faulted Rust's use of Result over exceptions, for example, but the maintainers at least acknowledge that other options exist and each has trade-offs. Not Pizlo and his f…

If you think you like Fil-C but aren’t able to see the specific way in which it’s better than Rust (more comprehensive safety), then what is it that you’re liking?

I'm able to see how it's safer than Rust but what I like is that it works with existing C++ code; I don't think the extra safety relative to Rust is worth the performance penalty (not to mention needing to recompile every dependency) and I doubt you think that, either

Re: Fil-C: Garbage In, Memory Safety Out [video]

#185
post #141

Earlier quoted context omitted.

This is a myth that seems to never die. OS kernels can and have been written in GC languages. Watch the video maybe? The whole presentation was running on a distro fully compiled with FillC.

The video has a slide which says, > I'm running on an OS where the entire userland is compiled with Fil-C/C++ (emphasis mine) Looking up https://fil-c.org/pizlix , that says, > The kernel is compiled with Yolo-C. So that you can compile the kernel, a copy of GCC is installed in /yolo/bin/gcc. Where do you see anything saying the Linux (the kernel) can be built with Fil-C?

Ok, I stand corrected: only the kernel userland was compiled with Fil-C.

However, I don't see why the full Linux kernel could not be compiled with Fil-C. It would be nice if Fil himself could explain what limitations there are, but the documentation does not list missing C/C++ features as far as I know, it only says it's "fanatically compatible" which I take to mean mostly everything should work?!

But to my point in general, here's a osdev.org wiki explaining how high level languages can and have been used for OS development (with the caveat that some Assembly code is required, which I believe is also true of kernels written in C): https://wiki.osdev.org/Languages

Re: Fil-C: Garbage In, Memory Safety Out [video]

#186

Earlier quoted context omitted.

Checked exceptions were actually the "right way" to do exceptions (if there is such a thing), the problem was just that developers hated them, but I think that draws the wrong conclusion. That tells me their syntax/usage was seen as too much forced boiler plate making code unwieldy, not that they didn't have benefits for correctness (something often not appreciated until years later). Unchecked exceptions lead to unh…

> developers hated them, but I think that draws the wrong conclusion Exception handling is just annoying from a syntax perspective. Also checked Exceptions have the problem that they bubble up types that a different layer shouldn’t even be aware of due to exception chaining (cause of a cause etc), unless you carefully re-throw them, which nobody did. Lower ceremony errors are just better to deal with.

Agreed, I really like Rust's Result type. Go's idea is okay, but they should force you to handle the error.

Re: Fil-C: Garbage In, Memory Safety Out [video]

#187

Earlier quoted context omitted.

I define memory safety in terms of capabilities, which is a mainstream definition. The worst that can happen in a race is that you read or write an object that would have been accessible even in the absence of races. The thing that makes races hard to debug in C or C++ is memory corruption; that doesn’t happen in Fil-C

I’m having a hard time understanding how these two things can be true at once. Just because the capability exists that somewhere in my program a valid pointer to a piece of memory might exist (what I understand accessible to mean), doesn’t mean that a particular write to that memory location under a data race that tears a pointer is valid. The data race may make a pointer that would never algorithmically appear in th…

I've spent some more time over the last day looking at Fil-C more closely, and come to the conclusion that this:

> The thing that makes races hard to debug in C or C++ is memory corruption; that doesn’t happen in Fil-C

is just blatantly false. It's almost as easy to corrupt memory in Fil-C as it is in C. Type confusion is still allowed. You can still do out of bounds buffer reads/writes as long as they fall within an allocation, so any intra-object stuff, as you might get in common packet or binary file parsing, is still about as unsafe as it was before.

Re: Fil-C: Garbage In, Memory Safety Out [video]

#188
post #153

Earlier quoted context omitted.

No, Rust does not have exceptions. Rust has unwinding, if you choose to compile your program with support for it, which you are free not to, and is trivially achieved by a single flag.

It's hard for me to think of a definition of "exception" which doesn't include Rust's panics: use std::panic::catch_unwind; fn throws_exception(){ panic!("hello"); } fn main(){ match catch_unwind(|| { throws_exception(); println!("Never reached"); }) { Ok(_) => (), Err(e) => println!( "threw an exception: {:?}", e.downcast_ref:: ().unwrap()) } } I can disable exceptions in rustc, but I can't disable the influence the…

No, panics are not exceptions. Exceptions are a mechanism for resumable error-handling. Rust's `catch_unwind` function is a last-ditch mechanism for failure isolation (motivated by preventing UB via unwinding across FFI boundaries), not a general-purpose error recovery mechanism. I have seen many Rust programs in my day, and not a single one has ever used `catch_unwind` in the way that (say) Java or Python programmers use try/catch for error handling, so this is as true in practice as it is in theory.

> I can disable exceptions in rustc, but I can't disable the influence they have on language and library design

It's the other way around. The fact that unwinding can be (and regularly is) trivially disabled is the ultimate motivator of why panics fundamentally cannot be used for error handling, and this is what influences language and library design (ultimately demanding `Result`-based error handling).

> Exceptions are the main reason you can't temporarily move something out from behind an exclusive reference, or return an error code from a Drop impl

No, this is absolutely untrue, and I'm not sure why you think this.

> Heck, Rust wouldn't even need destructors if it weren't for exceptions: the compiler could just tell you when you forgot to free something.

No, this is also untrue, and you appear to misunderstand the purpose of destructors. Feel free to provide code if you would like to try to make a more precise argument against unwinding.

Re: Fil-C: Garbage In, Memory Safety Out [video]

#189
post #158

Earlier quoted context omitted.

No, that's not how this works. The bug being utilized by cve-rs has such roundabout requirements that it's unlikely that anyone has ever triggered it without trying (to be clear, the Rust devs plan to fix it regardless). Meanwhile, here's a memory safety bug that Fil-C fails to catch, not because of a compiler bug, but by design: https://www.reddit.com/r/cpp/comments/1v4nw0k/filc_garbage_i...

I've encountered a few soundness holes in rust-lang in practice, but they've all been fixed before I managed to shoot myself in the foot with any of them: • `std::mem::uninitialized()`. It's now deprecated in favor of `MaybeUninit`. • `std::env::set_var(...)`. It's now marked `unsafe`. While I dodged the bullet, these fellows didn't: https://www.geldata.com/blog/c-stdlib-isn-t-threadsafe-and-e... • `#[no_mangle]`. It…

> I've encountered a few soundness holes in rust-lang in practice

Indeed, I'm trying to be careful not to claim that merely fixing #25860 at long last would make Rust's implementation suddenly beyond reproach. For that, we would need formal verification (which, so far, has at least been done by Ralf Jung's group for proving the correctness of large swathes of the standard library, but I wouldn't expect that to extend to the compiler anytime soon).

Re: Fil-C: Garbage In, Memory Safety Out [video]

#190
post #188

Earlier quoted context omitted.

It's hard for me to think of a definition of "exception" which doesn't include Rust's panics: use std::panic::catch_unwind; fn throws_exception(){ panic!("hello"); } fn main(){ match catch_unwind(|| { throws_exception(); println!("Never reached"); }) { Ok(_) => (), Err(e) => println!( "threw an exception: {:?}", e.downcast_ref:: ().unwrap()) } } I can disable exceptions in rustc, but I can't disable the influence the…

No, panics are not exceptions. Exceptions are a mechanism for resumable error-handling. Rust's `catch_unwind` function is a last-ditch mechanism for failure isolation (motivated by preventing UB via unwinding across FFI boundaries), not a general-purpose error recovery mechanism. I have seen many Rust programs in my day, and not a single one has ever used `catch_unwind` in the way that (say) Java or Python programmer…

> Exceptions are a mechanism for resumable error-handling. Rust's `catch_unwind` function is a last-ditch mechanism for failure isolation

Tomayto Tomahto.

> I have seen many Rust programs in my day, and not a single one has ever used `catch_unwind`

Yeah, cause it sucks. Hence my original point: all downsides and no benefits. Also how people use Rust's exceptions has no bearing on whether or not they are exceptions.

> The fact that unwinding can be (and regularly is) trivially disabled is the ultimate motivator of why panics fundamentally cannot be used for error handling

Unwinding can be disabled in C++, too. They still call them exceptions over there.

> you appear to misunderstand the purpose of destructors.

In a language with exceptions, destructors (or something similar like try-finally) are required to guarantee resource cleanup. In a language without exceptions, it is enough to simply write the cleanup code at scope exit points. Rust's static analysis is strong enough to ensure you do this correctly in the hypothetical world where the language does not have exceptions.

If your insinuation here is that I don't understand why you might still want destructors in the absence of exceptions, then you've missed my point.

> Feel free to provide code if you would like to try to make a more precise argument against unwinding.

I already linked the precise argument against unwinding. It's written by Niko Matsakis, one of the core Rust language designers. It explains both the "temporary move from behind an exclusive reference" point and the "return a value from a drop impl" point (which the article calls "must move").

Post reply on HN