Live data from Hacker News

"No way to prevent this" say users of only language where this regularly happens

xeiaso.net

301–310 of 342 posts

Re: "No way to prevent this" say users of only language where this regularly happens

#301

Earlier quoted context omitted.

But the only "technical merit" seems to be "omg it's more secure". I've literally never seen any other argument in favor of Rust.

Is security not a technical merit?

It is but there are other technical and non-technical merits too. "Security" doesn't trump all. If you need secure, turn off your computer.

I tried Rust and downloaded some projects that should be comparatively simple (e.g. text editor). "cargo build" downloaded and built about 500 dependencies. The Rust ecosystem had a chance to convince me, and it sure has some convincing results. But it wasn't my cup of tea.

If you included hundreds of dependencies to do what you can't easily do yourself within the "safe" framework, that may or may not be the language's or the ecosystem's failure. But the attribute "secure" for such a project is questionable. As NPM history or a certain guy or the recent events around the xz project illustrate well.

Re: "No way to prevent this" say users of only language where this regularly happens

#302
post #167

Earlier quoted context omitted.

I would love to be able to use Rust in my professional project. Unfortunately, I am doing high performance scientific computing. Rust doesn't even come close to offer any good alternative to cross-plateform, cross-device (CPU/GPU) libraries such as OpenMP Target, Kokkos, SYCL, ... I believe we need Nvidia/AMD to take Rust seriously (I'm not sure it is even possible without unsafe everywhere) to be able to offer good…

At least C++ provides the tools to avoid this kind of problems, if one choses to do so, instead of insisting into C idioms.

Yeah, part of the problem here is that the source code and the bug were in C, and people commenting here think C and C++ are the same thing.

There's a huge difference between C and C++. There's a big difference between 2001 version of C++ and 2021 version of C++.

The languages are so different that, in general, something that happens to one of them doesn't apply to the other.

Re: "No way to prevent this" say users of only language where this regularly happens

#304

Earlier quoted context omitted.

What they suggest? What I and the discussed article claim is that safe code isn't written because programmers don't want it. CVEs aren't caused by desires, they are caused by unsafe code.

Many people suggest to start gradually migrating to either Rust or start investing much more seriously in formally proving C/C++ code (which is IMO a huge endeavor). As I said in multiple other comments, I know there are valid cases for C/C++ where various factors prevent migration. I am not playing a little rebel revolutionary here, I am addressing the people who can migrate away but refuse to do so based on hand-wa…

> Petty stuff and I am pretty disappointed that people who bill themselves as "engineers" refuse to see objective evidence and hold on to only what they know.

I think it is widely accepted that Rust is more safe. (There comes the NPM factor too so it's not entirely clear). The thing is just, you are excited about this technology, and you are equating "engineering" with "security". You are willing to pretend that other merits and factors don't exist, including ergonomics of iteration, or inertia. I tried writing my usual explorative Win32 code in Rust for an evening. Well, it was painful and I went back to do it the way that works for me, that is supported by all the official tooling, and that the official documentation is written in. I also can't see myself reading reasonable Rust code quicker than I can read and write reasonable C code in a year down the line. It's just too intricate, too clever, too condensed / abstracted and at the same time too verbose. Another time I went to download a couple simple projects (e.g. text editor) to dabble a bit with. But the stuff was too opaque and had _hundreds_ of third-party dependencies, and I couldn't understand it well. So I lost interest.

Choice of language and ecosystem is an economic matter. They get chosen based on what one knows and what one wants and how one evaluates the possibilities. "Security" quite frankly is not the most important of concerns in most situations, and for a good reason. I frankly am not getting paid in finding the nicest or "most secure" way to write a piece of code, but to get it done. I am not interested in following the development of the hundreds of dependencies of my Rust project, and to change my data structures when they learned a better way to design the API to those "safe" data structures.

But you are seeing only "security". Well, it's most secure to just shut your computer off. So much for "objectivity". Maybe you _are_ the zealot!

Re: "No way to prevent this" say users of only language where this regularly happens

#305

Earlier quoted context omitted.

I had someone on Reddit r/webdev try to convince me that 'this' was not a mistake but a powerful language feature. A small glimpse into the mind of JS fans.

Sounds like something any programmer would say about their preferred language. Can't say you don't hear similarly crazy things about C, or C++, or Java.

True. But it's generally only common with older C-based languages where the goal was packing as many features as you can instead of high level design aimed to guard software from inexperienced overeager devs.

Re: "No way to prevent this" say users of only language where this regularly happens

#306

Earlier quoted context omitted.

Many people suggest to start gradually migrating to either Rust or start investing much more seriously in formally proving C/C++ code (which is IMO a huge endeavor). As I said in multiple other comments, I know there are valid cases for C/C++ where various factors prevent migration. I am not playing a little rebel revolutionary here, I am addressing the people who can migrate away but refuse to do so based on hand-wa…

> Petty stuff and I am pretty disappointed that people who bill themselves as "engineers" refuse to see objective evidence and hold on to only what they know. I think it is widely accepted that Rust is more safe. (There comes the NPM factor too so it's not entirely clear). The thing is just, you are excited about this technology, and you are equating "engineering" with "security". You are willing to pretend that othe…

> The thing is just, you are excited about this technology, and you are equating "engineering" with "security"

I do no such thing. I am not at all excited about Rust in fact anymore, I just learned where it excels at and I know when to reach for it.

> You are willing to pretend that other merits and factors don't exist, including ergonomics of iteration, or inertia

I have literally just responded to you before this comment where I made it clear that I stopped actively using Rust due to slower speed of iteration -- and that is said in another comment as well (including the inertia or lack-of-choice factor).

Can you please not misrepresent what I said? It's clearly written in at least two places.

> Choice of language and ecosystem is an economic matter. They get chosen based on what one knows and what one wants and how one evaluates the possibilities.

Which agrees with my "right tool for the job" take elsewhere in the thread. We're aligned.

> I frankly am not getting paid in finding the nicest or "most secure" way to write a piece of code, but to get it done.

Yes, and that explains why the programming at large is always teetering on the verge of ruin and stuff is barely working and is kept together by goodwill and spit. Though obviously worker bees like you and me can't change that reality for now. I have partially made my peace with that fact but not entirely; hence I reach for Rust every now and then.

> But you are seeing only "security". Well, it's most secure to just shut your computer off. Maybe you _are_ the zealot!

You seem to have gotten quite worked up and I'll ask you to stop. When I told you that I am open to discussion in a previous comment I was genuine.

Both Microsoft and Google said that from 60% to 75% of all C bugs are memory safety problems -- not my words, not my research, but that of two of the largest IT corporations out there.

That is proof. That is objective info. We can bikeshed and throw feces at each other until the end of time but there are people who got out there and gathered the info.

I refuse to be viewed as a zealot simply because I want to attack the lowest hanging fruit in terms of bugs and security vulnerabilities. No, that makes me both a pragmatic and a guy who is no longer willing to live with the broken status quo.

And I'll not agree with your polarizing take that "the only security is shutting your computer down". That's nonsense. You are simply not motivated to advance anything but your career. That's your right, surely, but at the same time it makes you dismiss any well-intended discussion about the current state of our profession and how can it be advanced further. You dismiss stuff off-hand and then you blame me for being a zealot. Not acceptable to me and I'll not take it.

So try and calm down and read better. We in fact agree on much more than you think but you are not seeing it because you seem to have formed an opinion of me before you even started writing.

Re: "No way to prevent this" say users of only language where this regularly happens

#307
post #198

Earlier quoted context omitted.

> Couldn't be reasons like inertia, or lacking the time, or not having the budget to change, or being too tired to learn, or any other such thing that'd let them be equal to you but just with differing priorities. This is already included in the "almost anything" expression and you are the 4th person deliberately (or accidentally?) not noticing it. There are valid cases for C/C++ both on technical merits and business…

> This is already included in the "almost anything" expression and you are the 4th person deliberately (or accidentally?) not noticing it. I genuinely think that : 1/ this field is dominated by a disproportionate amount of people with autistic traits 2/ their ability to reason only functions in the narrowest sense and their grasp of language (takes everything in the most literal sense, thinks in extremes, prone to pu…

Or maybe, just maybe they correctly interpreted "most" as "more than half" and "rarely" as "decidedly less than half", and actually disagree with the statement as is. And what can I say, "reasons like inertia, or lacking the time, or not having the budget to change, or being too tired to learn, or any other such thing" sounds exactly what almost anybody is confronted with -- so it doesn't exactly seem like just an _exception_ to the set of "almost anything".

But it's nice to add words like "autistic", "thinking in extremes", "painful", etc. to terminally bash on those people who are wrong and just can't learn...

Re: "No way to prevent this" say users of only language where this regularly happens

#308

Earlier quoted context omitted.

Mostly agreed with your comment though I still have to remark that every community has zealots and it's mystifying to me why are people so annoyed by Rust's. So it's hard to agree that "Rust is a cult". As you said, it's a pragmatic but also kinda niche language. I don't reach for it unless I can't do the job with others, easier and quicker to work with languages.

> ... every community has zealots and it's mystifying to me why are people so annoyed by Rust's. Because they're the ones that we keep hearing from right now. When it was the Haskell zealots showing up every few days, they were annoying. When it was the Lisp zealots, they were annoying.

Right now? Like where? Be specific and use arguments and not feelings.

Re: "No way to prevent this" say users of only language where this regularly happens

#309
post #226

Earlier quoted context omitted.

Are you sure? The C sphere overlaps with the UNIX one, for obvious reasons.

I can't remember Linux zealots raving irrationally about C though (although when googling I'm sure something will come up). Topics like Wayland or systemd on the other hand, oh my...

They are alive and well in this sub-thread of mine, quite a lot of them even. :) Down-voting and never engaging because who wants their bias challenged?

Re: "No way to prevent this" say users of only language where this regularly happens

#310
post #64

Earlier quoted context omitted.

Eh, Rust would be fine if not for the fact that it's too opinionated. Unfortunately you can't just have Rust's safety checks, without opting into restrictions that Rust designers force onto You that aren't inherent to safety checks, but more because 'that's a better practice (according to us)'. And also, easy and fast iteration just isn't there, both because of borrow checker restrictions and compile times

C/C++ being non-opinionated is the main source of the security vulnerabilities. Let's face it, it felt good to be a lone cowboy carrying a lot of responsibility and knowing what you are doing. I was there myself and I'll admit the ego trip was awesome. These times are long past and naturally, people refuse to adapt. > Unfortunately you can't just have Rust's safety checks, without opting into restrictions that Rust d…

> Show me something that does better and I'll switch tomorrow

Frankly this is a very bad decision. Because now you have C code, Rust code, and yet another language's code, and you're left with a mess that you have to integrate too.

Post reply on HN