Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tor in a safer language: Network team update from Amsterdam

lists.torproject.org

Post reply on HN
Print view View original

111–120 of 254 posts

Re: Tor in a safer language: Network team update from Amsterdam

#111

Post by kodr »

socmag wrote: post #92

I live and love in Amsterdam and Golang seems to be the quintessential hipster language for this quintessentially hipster city. Booking.com's soup du jour if you will. Basically, if you aren't using JavaScript in a web shop, and you claim to be a "full-stack" "ninja", then probably you are using Go around here as a jobbing programmer. I know that sounds terribly cynical and obviously a massive generalization but that…

Go doesn't really have a package manager (and that's a problem), it pulls the sources of the dependencies from github for example. There are multiple tools [1] to manage versioning, but Google only released recently (end of january) an official tool, still in beta.

[1] https://github.com/golang/go/wiki/PackageManagementTools

Re: Tor in a safer language: Network team update from Amsterdam

#113

Post by 59nadir »

JepZ wrote: post #102
searchfaster wrote: post #6

When I read safer language, 'Rust' came into mind automatically.. Not sure if 'Rust' will ever be as popular as golang but certainly see a future with it popping up everywhere mission critical / super safe software is required.

I am afraid Rust will become much more popular than Go is atm. I think the C++ crowd will embrace it as soon as it will be mature. I am sure it is better than C++, but I still like the concepts and syntax of Go much better. But as C++ programmers obviously never care about readability and simplicity, I am pretty sure they will take Rust. After all, Rust is a decent language and as users, we will all benefit from the…

> ... but I still like the concepts and syntax of Go much better

The concept of not having features because someone on your team might use them? You subtly say that Rust is a worse language because it doesn't seem like it was designed in the 80's, when clearly as a language (together with the compiler), it's objectively better than Go.

Re: Tor in a safer language: Network team update from Amsterdam

#114

Post by agumonkey »

ASinclair wrote: post #31
sfilargi wrote: post #20

As a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular. It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened.

> As a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular. You can pick it up in a weekend. A lower entry bar means more people will try it out. > It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened. It was developed in a large en…

IIUC Pike spent most of his career in research right ?

Re: Tor in a safer language: Network team update from Amsterdam

#115

Post by Sanddancer »

ianopolous wrote: post #69
nickpsecurity wrote: post #15

Since bitexploder asked, I'll add what I wrote on this on other forums. If it's about secrets or anonymity, make sure you always use a safe language that supports careful control and reasoning about both memory and CPU time. The reason is that this enables covert, channel analysis for vulnerabilities that leak secrets through storage and timing. It's why I wanted Freenet to ditch Java aside from the obvious reasons.…

G'day Nick! Java is getting an AOT compiler in July (Graal, http://openjdk.java.net/jeps/295 ) that will let you AOT compile parts, or all, of your program, including the JVM modules themselves. This would seem to leave the GC as the main source of side channel vulnerabilities. The GC itself will become more pluggable as well, with a pure Java implementation. What requirements would you put on a GC for side channel s…

A concurrent GC running on a single processor machine is still going to pause. There are still other ways to get into situations where an attacker can cause the gc to kick in in ways where you can get information -- find a few CPU-heavy functions that nudge the GC to kick in when and where you want it. Harder, but even a background GC can wiggle into the foreground.

Re: Tor in a safer language: Network team update from Amsterdam

#116

Post by agumonkey »

bluejekyll wrote: post #47
ue_ wrote: post #35

Earlier quoted context omitted.

To be honest, you can probably also pick up Lisp in a weekend, experienced programmer or not. The syntax is also simpler.

But all those parentheses! I know it sounds like a lame reason to dislike a language, but I've always found staring at Lisp to be so much more difficult and distracting than C-style syntax.

Parens are not syntax to me. Syntax is that ADA thought ' meant string indexing.

Re: Tor in a safer language: Network team update from Amsterdam

#117

Post by [deleted] »

bwanab wrote: post #96
chrismealy wrote: post #44

Earlier quoted context omitted.

Go is designed for average programmers working in a huge organization. That's why its dullness is a virtue.

Seems weird that from what I hear about the intense interview process that Google programmers go through that they'd feel a need to dumb down the language of choice.

[deleted]

Re: Tor in a safer language: Network team update from Amsterdam

#118

Post by kbenson »

bluejekyll wrote: post #55
eternalban wrote: post #43

Not sure why Ada is not taking off these days. It is mature and has all the safety and concurrency bells and whistles: http://www.adacore.com/uploads_gems/07_safe_secure_ada_2005_... https://en.wikibooks.org/wiki/Ada_Programming/Tasking http://courses.cs.vt.edu/cs5204/sp99/Overheads/6UP/6UPCSPand...

1) Two words: "begin" and "end"; 2) Unix, C is so fundamental to building software, that I think any language that doesn't share syntax with it is doomed. Having a common syntax helps in learning new languages, IMO, and can also be a launching point for differing semantics...

Regarding #2, there's definitely a penalty a language pays for not following C-like syntax and semantics, as people consider it "harder" to learn, because people generally discount the time they've already put into learning similar languages when considering how easy a language is to learn. I suspect someone that knows Lisp but not C might find Clojure easier to learn than Rust, or even Python. The less software in use written in C, the less fundamental it is.

There's also a penalty a language pays for following a C-like syntax and semantics but diverging in specific but significant ways. In this category, I present Perl, which much of whole generation of users decided to treat like C, and got very confused and upset when it didn't always behave like they expected (which I maintain is because they didn't actually understand the language as well as they thought). There's a penalty for being very like something else to the point that people can mostly ignore the differences, but occasionally those differences come out to bite them if they haven't actually learned what they are.

Re: Tor in a safer language: Network team update from Amsterdam

#119

Post by theparanoid »

agumonkey wrote: post #114
ASinclair wrote: post #31

Earlier quoted context omitted.

> As a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular. You can pick it up in a weekend. A lower entry bar means more people will try it out. > It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened. It was developed in a large en…

IIUC Pike spent most of his career in research right ?

Yes. Pike, Thompson, and Griesemer were at Bell Labs before Google.

Re: Tor in a safer language: Network team update from Amsterdam

#120

Post by vertex-four »

JepZ wrote: post #102
searchfaster wrote: post #6

When I read safer language, 'Rust' came into mind automatically.. Not sure if 'Rust' will ever be as popular as golang but certainly see a future with it popping up everywhere mission critical / super safe software is required.

I am afraid Rust will become much more popular than Go is atm. I think the C++ crowd will embrace it as soon as it will be mature. I am sure it is better than C++, but I still like the concepts and syntax of Go much better. But as C++ programmers obviously never care about readability and simplicity, I am pretty sure they will take Rust. After all, Rust is a decent language and as users, we will all benefit from the…

I've... never had a problem reading Rust code. It's generally well-typed, and makes good use of "automatic" error handling constructs to ensure errors flow upwards without visually polluting the success case.

Whereas with Go code, I have to filter out all the error handling (which often takes up 2/3rds of lines of code, even when it's just "if there's an error, return the error" which it almost always is), wade through the mass of functions that take interface{} and cast it to something internally, etc etc.

I've tried programming in Go and I find it horrifying - I either get to ignore errors or spend ~80% of my code doing this, repeatedly, a few times per function:

    foo, err := bar()
    if err {
        return nil, err
    }
Post reply on HN