Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a bug in the hyper HTTP library

blog.cloudflare.com

Post reply on HN
Print view View original

81–90 of 97 posts

Re: We found a bug in the hyper HTTP library

#81

Post by inexcf »

microgpt wrote: post #78
inexcf wrote: post #75

Earlier quoted context omitted.

Isn't that like saying there can never be a language with safe concurrency since the code could interact with C code that segfaults? I dunno this kinda reminds me of the 10/10 Rust CVE that turned out to be cmd.exe on Windows not sanitizing inputs and languages like Java just labeled it "won't fix".

You mean the one where Windows doesn't have argv the way Unix does, and instead just has a single string that is interpreted slightly differently by each executable? That is a language making false assertions about how the underlying platform works, causing an impedance mismatch that is impossible to fix.

Yeah, the one most languages (except for Rust)* decided was not a language problem and did not fix.

*should clarify, Node.js, PHP, and Haskell did ship patches. Python, Ruby, Erlang, and Go opted for documentation updates; Java went "won't fix."

Re: We found a bug in the hyper HTTP library

#82

Post by atoav »

chlorion wrote: post #53
atoav wrote: post #29

Earlier quoted context omitted.

You could say the exact same thing about safety belts and airbags in cars after someone has died in a crash. Why even bother with measures that prevent many problems if they won't prevent all of them, right?

This is the argument I like too. It's the same argument anti-vaxers love to make. "Well you can still get covid after getting the shot", which is something I read and heard quite a lot. That doesn't make the thing useless. Humans are really dumb.

The older I get the more I realise that I have taken way to much of my mathematical intuition for granted.

This I'd an example of people not grasping simple probabilities. Forced to play Russian Roulette they prefer the revolver with 5 bullets in its chambers or the one with just a single bullet, because in both cases people die.

Other concepts many people do not grasp are feedback-loops and exponentials. And by not grasp I mean: You explain it to them, the nod along and when faced with the thing in slightly different clothes they will actively deny it'd existence.

Re: We found a bug in the hyper HTTP library

#83

Post by inexcf »

microgpt wrote: post #77
tetha wrote: post #76

Earlier quoted context omitted.

But it did not take 2 threads within the same application to interact in a bad way on data the system controlled to cause this problem. This reads more like an overly broad transition in a deterministic state machine. The fix was to split up a bad transition to shutdown.

Concurrency bugs don't have to be within a single process.

By that definition, every write() call that doesn't check for EAGAIN is a concurrency bug you're racing the disk controller. The term stops meaning anything.

Re: We found a bug in the hyper HTTP library

#84

Post by Ygg2 »

tialaramex wrote: post #64
Ygg2 wrote: post #61

Earlier quoted context omitted.

No. Anyone expecting that hasn't read No Silver Bullet essay.

Actually I suspect that Rust is a Silver Bullet in that sense. That essay seems to be a case where people know of the essay but haven't read it. Normally in English a "Silver Bullet" is something much bigger, a panacea or cure all which entirely solves a problem but in his essay Brooks is talking about order-of-magnitude improvements, and that looks a lot like Rust. Brooks was expecting such "Silver Bullet" improveme…

> Actually I suspect that Rust is a Silver Bullet in that sense.

Not really. If anything I'm pretty sure Fred would compare it to Ada:

    > Nevertheless, Ada will not prove to be the silver bullet that slays the software productivity monster, It is, after all, just another high-level language, and the biggest payoff from such languages came from the first transition, up from the accidental complexities of the machine into the more abstract statement of step-by-step solutions.
And I think he'd be on the money. Rust and Ada are revolutionary languages in their own right, but 10x holy grail they aren't.

Re: We found a bug in the hyper HTTP library

#85

Post by Twey »

microgpt wrote: post #70
Twey wrote: post #57

Earlier quoted context omitted.

All recurrent people problems are system problems.

As seen by the fact that forcing the programmer to write let _ = to silence the warning did not fix the bug. You know what might've solved this though? Using threads instead of async

I think that's more of a workaround than a fix. Relying on unstructured concurrency does mean you no longer have to understand the scheduling of your program's fibres (… until you do), but it introduces a bunch of new footguns around things like correct cancellation, error propagation, and predicting resource lifetimes.

Re: We found a bug in the hyper HTTP library

#86

Post by tialaramex »

Ygg2 wrote: post #84
tialaramex wrote: post #64

Earlier quoted context omitted.

Actually I suspect that Rust is a Silver Bullet in that sense. That essay seems to be a case where people know of the essay but haven't read it. Normally in English a "Silver Bullet" is something much bigger, a panacea or cure all which entirely solves a problem but in his essay Brooks is talking about order-of-magnitude improvements, and that looks a lot like Rust. Brooks was expecting such "Silver Bullet" improveme…

> Actually I suspect that Rust is a Silver Bullet in that sense. Not really. If anything I'm pretty sure Fred would compare it to Ada: > Nevertheless, Ada will not prove to be the silver bullet that slays the software productivity monster, It is, after all, just another high-level language, and the biggest payoff from such languages came from the first transition, up from the accidental complexities of the machine in…

> And I think he'd be on the money. Rust and Ada are revolutionary languages in their own right, but 10x holy grail they aren't.

Google reports 4x fewer (and still falling) rollbacks for Rust versus C++ in their Android development for example. That's not 10x but it's pretty sizeable.

Re: We found a bug in the hyper HTTP library

#87

Post by Atotalnoob »

gmueckl wrote: post #73
worldsavior wrote: post #18

> We spent six weeks chasing a nearly invisible bug — a race condition that occurred only under specific conditions — in the hyper library that impacted how the Images binding returned processed image data back to the client. In the end, it took four lines of code to fix it. That's a long time, must be frustrating.

It is a long time and it gets frustrating when there is significant time where there is flailing with no visible progress. I have had long bug hunts (~a month each) and witnessed ones that took much, much longer. But the longest one I witnessed was drawn out because reproduction was initially unreliable and could take weeks to months. Thankfully, reproduction was by letting a box sit in a corner while tje people invo…

Sometimes the best option is to enhance observability and see when it happens again

Re: We found a bug in the hyper HTTP library

#88

Post by conradludgate »

pseudony wrote: post #48
c0balt wrote: post #34

Earlier quoted context omitted.

This does not appear to be a concurrency bug though?

“ a race condition that occurred only under specific conditions — in the hyper library”

Fearless concurrency has always been regarding data races. There's no fear of undefined behaviour due to a race condition.

Rust has never promised to solve race conditions as a whole.

Re: We found a bug in the hyper HTTP library

#89

Post by pjmlp »

tialaramex wrote: post #86
Ygg2 wrote: post #84

Earlier quoted context omitted.

> Actually I suspect that Rust is a Silver Bullet in that sense. Not really. If anything I'm pretty sure Fred would compare it to Ada: > Nevertheless, Ada will not prove to be the silver bullet that slays the software productivity monster, It is, after all, just another high-level language, and the biggest payoff from such languages came from the first transition, up from the accidental complexities of the machine in…

> And I think he'd be on the money. Rust and Ada are revolutionary languages in their own right, but 10x holy grail they aren't. Google reports 4x fewer (and still falling) rollbacks for Rust versus C++ in their Android development for example. That's not 10x but it's pretty sizeable.

Which they could equally achieve by reducing even further the use of NDK, or moving more stuff into Kotlin/Java processes using Android IPC.

Naturally there are several ideological questions between that approach from the anti GC crowd, and adopting Rust instead.

Not that breaks the C++ vs Rust from your comment, though.

Re: We found a bug in the hyper HTTP library

#90

Post by tancop »

pjmlp wrote: post #89
tialaramex wrote: post #86

Earlier quoted context omitted.

> And I think he'd be on the money. Rust and Ada are revolutionary languages in their own right, but 10x holy grail they aren't. Google reports 4x fewer (and still falling) rollbacks for Rust versus C++ in their Android development for example. That's not 10x but it's pretty sizeable.

Which they could equally achieve by reducing even further the use of NDK, or moving more stuff into Kotlin/Java processes using Android IPC. Naturally there are several ideological questions between that approach from the anti GC crowd, and adopting Rust instead. Not that breaks the C++ vs Rust from your comment, though.

thats how you get bloated memory use and disk space. you know, the things everyone complains about when it comes to modern tech
Post reply on HN