Elixir is still safe

Post by devoutsalsa » Mon, Jul 24, 2023, 11:31 PM UTC

rozap wrote: post #11

e-dant wrote: post #8

Without stepping on anyone’s toes, I think we can agree that “safety” could be broken down a bit. Memory safety, thread safety, fine… but there’s a whole forest past those trees. Is it a safety feature to type-check regular expressions using dependent types? Is Python a security vulnerability because the performance can be unpredictable? I don’t know. Rust, for that matter, doesn’t protect you from running out of mem…

> I just don’t see how it’s so flat. Because people like making wild and provocative claims to motivate writing a paper for which the conclusion was already decided. Anyone who has used, I dunno, any of programming languages that are being discussed has a more nuanced take, and isn't spending time trying to force all things into Box A or Box B. Elixir/Erlang has a pleasant concurrency model. It does some things well,…

Post by hosh » Mon, Jul 24, 2023, 11:46 PM UTC

csoups14 wrote: post #10

alex_lav wrote: post #6

Earlier quoted context omitted.

The original article didn't disprove the existence of vulnerabilities though. Is "Concurrency is hard and I think this concurrency model is easier" "proof"? Did you read either article?

From the original "Elixir is Safe" article: > 3. “Shared nothing” concurrency > Item 3 is the killer one for safety. Like two people, two processes cannot share memory; they can only communicate by sending each other messages. This makes impossible an entire class of thread safety issues. "Elixir is Safer" might have been a better phrasing, but you're misrepresenting the contents of the article if you're claiming tha…

Post by devoutsalsa » Tue, Jul 25, 2023, 12:19 AM UTC

rozap wrote: post #15

devoutsalsa wrote: post #12

Earlier quoted context omitted.

“What is sending a message to my process and making it crash?!” “My synchronous reply timed out, so why I am I getting a message after the timeout?!” “Why did deleting my build directory fix the compile error?!” “How do I keep my app from crashing when my supervisor crashed too many times in a given timeframe?!” So many adventures to be had.

Plenty. But I'd take those trivial issues over a blob of microservices any day of the week. In any case, the answer continues to be "it depends". But people will continue to look for "one weird trick" solutions to every problem.

Post by zamalek » Tue, Jul 25, 2023, 12:57 AM UTC

csoups14 wrote: post #10

alex_lav wrote: post #6

Earlier quoted context omitted.

The original article didn't disprove the existence of vulnerabilities though. Is "Concurrency is hard and I think this concurrency model is easier" "proof"? Did you read either article?

From the original "Elixir is Safe" article: > 3. “Shared nothing” concurrency > Item 3 is the killer one for safety. Like two people, two processes cannot share memory; they can only communicate by sending each other messages. This makes impossible an entire class of thread safety issues. "Elixir is Safer" might have been a better phrasing, but you're misrepresenting the contents of the article if you're claiming tha…

Post by fuzztester » Tue, Jul 25, 2023, 1:49 AM UTC

Kranar wrote: post #19

e-dant wrote: post #8

Without stepping on anyone’s toes, I think we can agree that “safety” could be broken down a bit. Memory safety, thread safety, fine… but there’s a whole forest past those trees. Is it a safety feature to type-check regular expressions using dependent types? Is Python a security vulnerability because the performance can be unpredictable? I don’t know. Rust, for that matter, doesn’t protect you from running out of mem…

Safety means no undefined behavaior. It does not mean free of bugs, or security issues, or free from crashes. It simply means every operation has well specified semantics.