Hacker News new | ask | show | jobs
by pdimitar 1229 days ago
Nobody is saying they do it casually. People genuinely believe they are without fault, which leads to stuff like Heartbleed (and many others; from 2017 to 2020 there was a number of HN submissions about various well-known pieces of software having buffer under/over-flows).

I heard the ideal theory you cite, many many times. Yet many people still do mistakes. How does that fit in your world-view?
2 comments
megous 1229 days ago
Not sure what ideal theory you mean. I didn't state any.

Most of the code in my Linux distro is written in C, yet I don't see many segfaults or data corruption in my favorite tools, even those exposed to the internet. It just works. Supposed buffer overflows and double-frees don't affect me daytoday despite 95%+ code I run being written in C, "catastrophic" issues like heartbleed notwithstanding.

People make mistakes, sure. They'll make them with "safe" languages, too. Rust programs are not immune from mistakes. They'll just be of a different kind.

PHP is memory safe, and there were many easily exploited (not just exploitable) vulnerabilities in software written with PHP. (and it doesn't even have escape hatches out of its memory safety)

link
pdimitar 1229 days ago
> If you want to iterate over an array, you don't just iterate until infinity

And yet I am sure we all have witnessed code bases where this was done. At least I and no less than 40 other colleagues I knew have.

The "ideal theory" refers to the old adage of "just be a good programmer, duh" which historically has been proven to be a complete BS.

> Rust programs are not immune from mistakes. They'll just be of a different kind.

Glad we agree on something. I want memory safety problems out of the equation.

Also please don't fight straw-men -- all Rust discussions seem to always spiral from the very reasonable premise of "Rust eliminates a class of bugs" to "But with Rust you can still make logical mistakes!!!!!", and nobody ever claimed the opposite anyway...

link
Yoric 1229 days ago
For context, an obligatory reference (slash shameless self-promotion) to definitions of safety and safe languages.

https://yoric.github.io/post/safety-and-security/

link