• 15 Posts
  • 91 Comments
Joined 1 year ago
cake
Cake day: June 15th, 2023

help-circle
  • Then why do you bring that up, after the argumentation that people did not want to learn? Look I try to be constructive. There are people who do not want to learn, but saying that all security issues is to attribute to that is wrong. Lot of the best engineers and programmers do their best, long time experts and groups, who still make mistakes.

    What i"m saying is, that your example is not applicable in this discussion, because you are not writing systems programming for operating systems (such as Android or Windows or Linux), which are used by millions of people and ton of hackers try to find vulnerabilities. The best programmers in C and C++ make these mistakes that Rust would prevent (or make it much easier to find and eliminate).

    That’s the point. It’s not about these experts not wanting to learn or not caring. We are not talking about the typical programmer for a website for company x or a fake game programmer for Android.


  • And you didn’t care what I wrote. Its not about your bubble and nobody cares what problem you had. You are bringing your argumentation in a topic up, where it does not apply. We are specifically talk about problems that Rust could help against. And you take your argumentation of your personal experience as a reason that people at Google, Microsoft and other big companies didn’t want to learn and don’t care.

    And when I point it out, then it means people didn’t care to understand your example.

    Look, you can tell what you want, using and adopting Rust has real impact in writing and maintaining complex and important code that is secure. There are reports left and right. It’s not hard to understand why Rust prevents or helps with these issues.


  • That’s your little bubble. I don’t think its just not caring, its just super hard to write secure and correct code all the time. Especially writing operating systems such as Windows, Android and Linux Kernel in general is much different world. It’s not like those engineers trying to code correctly since computers actually exist.

    But lets assume you are correct and all of this comes down to people not caring. Why don’t you get the job if you are really that good? I’m sure there are a few golden programmers like you, that the world would need. Or the industry adopts Rust (or a similar language) and have lot of security by default for free, for everyone. If its true what you are telling, then using such a language will make a difference.

    And we are not speaking theoretically. There are metrics from Microsoft (and now from Google) which show improvements and advancements since Rust was adopted. But really, to say that those engineers and programmer don’t care is just a wrong statement. Okay, you have no metrics to prove your point, but you are questioning reports from Google.


  • nobody cared to teach the new devs, memory safety and the devs didn’t care to learn it themselves even as they became senior devs.

    It does not matter how much you teach, humans are not perfect. The industry changes all the time, everyone updates libraries, systems change, editing others code is not as easy to understand, and so on. There is a reason why Microsoft, Google and Linux have experts in their fields for decades and yet these mistakes happen.

    And it makes sense why using Rust would reduce memory vulnerabilities. Because the language has features in place to either prevent or make those mistakes more difficult to happen. If you understand what Rust offers, then its not science to understand why. Google is not the first and only big company reporting this either.










  • So yeah, exception as part of explicit function signature is a vast improvement, I completely agree

    Hmm, I’m not sure if you are being sarcastic. In my reply I didn’t meant encoding Exceptions into Type system. Is this a type and you probably meant “Error Types as part of” instead “exception as part of”?

    Honestly I don’t know how Exceptions as part of type system would even look like. Because each function call in a chain would need to have all information from previous function call, otherwise that information gets lost to the next caller. The problem is the hierarchy of function and method calls. Somewhere some objects and functions can be edited to Throw a new Exception, that is not handled through the entire chain. And for the higher function caller, there is 0% way of knowing that (through code, besides documentation off course).


  • Read my reply with a handful of sea salt. I just read tutorials and documentation a bit and did Hello World.

    Zig is pretty cool too! It can run C code directly just like C++ does (I think), kind of drop in replacement. From my reading so far, Error Handling is kind of a marriage between Go’s and Rust’s Error handling. Actually pretty cool. It has Error Types, but is kept relatively simple and doesn’t force to do all the stuff. It has Try and Catch keywords to handle errors elegantly, but don’t be fooled, this has nothing to do with Try…Catch blocks for Exceptions. Zigs Try and Catch are more like Rusts Result type handling, at least from what I read so far.

    I lean more towards Zig than Go, but it still has not reached stable 1.0 release.


  • My anecdotal experience is that Rust code, for example, has more calls to unwrap than I’d like. The problem here is that simply unwrapping results will crash the program on errors that could have been a user-visible error message with exceptions.

    unwrap() is explicitly not handling the error in a Result type. If you must do this, then at least use except(), to unwrap the code but with an error message if program crashes. Its the equivalent of having Exceptions and then not handling that exception. Therefore your critique is not valid here.

    One problem with Exceptions is, you never know what code your function or library calls that can produce an exception. It’s not encoded in the type system or signature of the function. So you need to pray and try catch all possible exceptions (I look at this from Pythons perspective), if you don’t want a Catch…All, which then you wouldn’t know what error this actually is. And you still don’t know where this error came from or happened in the code, how deep in the function call chain? Instead Errors as Values means its encoded in type system and you can directly see what errors the function can cause and (in Rusts case) you must handle the error, otherwise program won’t compile. You don’t need to handle anything else in this context. Compiler ensures that all possible errors are handled (again within context of our discussion). Vast improvement!





  • I don’t like it either, but I’m not entirely sure why. Maybe the biggest flaw to me is it uses Python style indentation for structuring as part of data logic. It doesn’t feel like a configuration language to me and it does not feel simple too. It’s also unlike most programming language structures (maybe besides Python), so it looks weird to read and write. Other than that, I don’t know exactly why I don’t like this format much. Admittedly, I did not do much in YAML, so because lack of experience take my opinion with a thick grain of salt.

    We have JSON and TOML. I quiet like TOML. We have “better” alternatives, that are probably easier to parse. And therefore there is not much need for YAML. Maybe if YAML was the default config format for Python it would get off the ground and be accepted more often.