- cross-posted to:
- hackernews@lemmy.smeargle.fans
- hackernews@derp.foo
- cross-posted to:
- hackernews@lemmy.smeargle.fans
- hackernews@derp.foo
You must log in or register to comment.
How do you succinctly call a language that has all behavior defined or equivalently no undefined behavior (aside from designated regions)? “Memory safety” is nice since it’s concise. Is there another term? Maybe just a “safe” language?
How do you succinctly call a language that has all behavior defined or equivalently no undefined behavior (aside from designated regions)?
I don’t understand this fixation with undefined behavior. Its origins are in the design decision of leaving the door open for implementations to employ whatever optimization techniques they see fit without the specification get in the way. This is hardly a problem.
In practical terms, developers are mindful to not rely on those traits because as far as specifications go they have unpredictable implications, but even so they are never a problem. I mean, even in C and C++ it’s trivial to tweak the compiler to flag undefined behavior as warnings/errors.
Sometimes it sounds like detractors just parrot undefined behavior as some kind of gotcha in ways I’m not even sure they fully understand.
What problem do you think that undefined behavior poses?
It sounds like you’ve never had to do real work in a language kind C++ where the compiler is always trying to play gotcha with undefined behavior. You can kind of use tools like AddressSanitizer to catch undefined behavior in testing but you certainly cannot just have a compiler catch it for you like you claim.
It sounds like you’ve never had to do real work in a language kind C++ where the compiler is always trying to play gotcha with undefined behavior.
I have over a decade of professional experience working with C++, and it’s likely you already used software I worked on.
Throughout those years, the total number of times where undefined behavior posed a problem in any of the projects I worked on was zero.
Please enlighten me about the insurmountable challenges posed by undefined behavior.
Dangling pointers, double frees and the like, mostly. Tell me you haven’t run into those and I’ll laugh in your face and call you a liar.
Dangling pointers, double frees and the like, mostly.
Those are bugs you wrote in. UB is not the problem. Your code is the problem.
Tell me you haven’t run into those and I’ll laugh in your face and call you a liar.
I ran into bugs. Do you understand that UB is not the problem if you’re pushing broken code? It’s not the C++ standard that’s messing up if you’re writing in use-after-free bugs.
The irony of your comment is that some implementations take advantage of UB to prevent programs from crashing and actually continue to work in some scenarios such as use-after-free and even dereferencing null pointers. But that’s not caused by UB, is it? Those problems are caused by developers like you and me who didn’t knew what they were doing and even failed to either pay attention to the errors flagged by compiler and static code analysis tools, or even failed to onboard one.
I mean, think about it for a second. Let’s say we have a magic wand that can update any C and C++ standard version of your choosing, and we specify that each and every single instance where behavior is left undefined is updated to specify that the program should automatically crash. Awesome, no more UB. What does this mean for your code? Is it now bug-free? Is it now working well after crashing all the time due to the code you added? What role did UB played in this mess?
Do you understand this?
I repeat: detractors just parrot undefined behavior as some kind of gotcha in ways I’m not even sure they fully understand.
some implementations take advantage of UB to prevent programs from crashing and allow them to continue after encountering a UAF etc.
Could you provide examples of this?
I use C++ all the time, undefined behavior is not something I encounter ever. I run undefined behavior sanitizer often.
I use C++ all the time, undefined behavior is not something I encounter ever. I run undefined behavior sanitizer often.
From the looks of some of the posts showing up in this thread, I doubt the bulk of the commenters portraying UB as the root cause of any problem have any experience at all with C or C++. They are clearly resorting to unrealistic strawmen to pretend UB is something that it clearly is not. That just goes to show their technical background and the substance behind their claims. I really don’t know how this helps advocating for Rust.
I’m just a noob when it comes to low level languages, having only been in C# and python. But I took a course on C++ and encountered something that didn’t seem right. And I asked and got the “that’s undefined behavior”. And that didn’t quite sit tight with me. We don’t know what will happen? It’ll probably crash? Or worse? How can one not know how a programming language will perform? I felt it was wrong.
Now, it’s quite some time since that happened, and I understand why it’s undefined. But I still do not think it should be allowed by default. C and C++ both are “free to do as you want” languages, but I don’t think a language should let you do something that’s undefined especially if you aren’t aware you’re doing it. Everyone makes mistakes, even stupid ones. If we can make a place where undefined behavior simply won’t happen, why not go there? If you need some special tricks, you can always drop the guard where you need it. I guess I’m just reiterating the article here though. But that’s the point for me, if something can enforce “defined behavior” by default then I’d want that.
Easy to say, but in the real world those are things you don’t do so who cares? You mostly hear about it from people who use other languages and want to pick on C
What problem do you think that undefined behavior poses?
Not sure exactly what you mean, could you elaborate or rephrase? What problem does it not pose? I mean any program with undefined behaviour is basically by definition wrong. Avoiding undefined behaviour is definitely a good thing.
Those programs are wrong already. you can insert lots of checks and slow down correct code, but that results are still wrong as the code has a bug.
What do you mean wrong “already”?
what is the usecase for going beyond maxint? Sure I can make it defined, but your program will have a bug if you do it. Defined just means platforms with a different behavior have to insert checks all over for something that rarely haypens
Okay but I would much rather deal with a defined bug than an undefined one. A defined bug is still a bug, but at least it is predictable. A bug from undefined behaviour is chaos and could do conceivably anything.
A defined bug is at least somewhat limited in what it can do. In Rust, many of those cases would panic for instance. That’s much better than, say, continuing execution with garbage data.
what is the usecase for going beyond maxint?
There are many examples of applications that leverage integer overflow, either wrapping around or saturating values.
What do you mean wrong “already”?
This is one of the problems in these discussions about undefined behavior: some people feel very strongly about topics they are entirely unfamiliar with.
According to the C++ standard, “undefined behavior may be expected when this document omits any explicit definition of behavior or when a program uses an erroneous construct or erroneous data.” Some examples of undefined behavior still lead to the correct execution of a program, but even so the rule of thumb is to interpret all instances as wrong already.
some people feel very strongly about topics they are entirely unfamiliar with.
Some people also feel strongly about topics they are very familiar with 🙂. I have experienced my fair share of undefined behaviour in C++ and it has never been a pleasant experience.
Some examples of undefined behavior still lead to the correct execution of a program, but even so the rule of thumb is to interpret all instances as wrong already.
Sure, sometimes use of undefined behaviour works, but this is more dumb luck than a rule of thumb that you should use. The idea of “it’s undefined behaviour but it works when I test it so it’s fine” is downright dangerous. That kind of careless attitude might be okay for your hobby projects with low stakes, but for any serious professional software development, you’re setting a landmine for yourself and/or your coworkers, employer and users.
Undefined behaviour might work when you test it and it might work when you run it the 1000th time. At the same time it may fail on the 1001st run and it can also easily completely fail when compiling again or simply compiling with a different compiler version. Undefined behaviour is not predictable and is always wrong.
See also https://predr.ag/blog/falsehoods-programmers-believe-about-undefined-behavior/
Some people also feel strongly about topics they are very familiar with 🙂. I have experienced my fair share of undefined behaviour in C++ and it has never been a pleasant experience.
If you had half the experience you claim to have, you’d know that code that triggers UB is broken code by definition, and represents a bug that you introduced.
It’s not the language’s fault that you added bugs to the code. UB is a red herring.
Sure, sometimes use of undefined behaviour works (…)
You missed the whole point of what I said.
By definition, UB does not work. It does not work because by design there is no behavior that should be expected. By design it’s up to the implementation to fill in the blanks, but as far as the language spec goes there is no behavior that should be expected.
Thus, code with UB is broken code, and if your PR relies on UB then you messed up.
Nevertheless, some implementations do use UB to add guardrails to typical problems. However, if you crash onto a guardrail, that does not mean you know how to drive. Do you get the point?
Not sure exactly what you mean, could you elaborate or rephrase?
There is nothing to rephrase. I asked what problem do you think that undefined behavior poses. That’s pretty cut-and-dry. Either you think undefined behavior poses a problem, and you can substantiate your concerns, or you don’t and talking about undefined behavior being a concern is a mute point.
TL;DR Linkedin clickbait
I did read the article and it’s maybe it’s just me being a bitter, spiteful & petulant being, obnoxious to talk with but this article sucked. Every point ranged hollow.
It was really bad because the author in his 11y of writing Rust never once heard about the philosophy of Rust/Unsafe Rust.
The goal of MSLs is to reduce UB, and Rust want to do that but keep the speed and the productivity.
Of course, at some point you may need some C/C++ because it’s the cornerstone of modern programming but what you are calling with FFI are audited, open-source libraries so memory leaks/undefined behaviour is minimised.
- Rust is implemented in Rust so FFI is greatly minimised if we follow the logic of the blogger.
the author in his 11y of writing Rust never once heard about the philosophy of Rust/Unsafe Rust.
Are you…aware of who the author is? He literally co-wrote The Book, aka The Rust Programming Language.
It was really bad because the author in his 11y of writing Rust never once heard about the philosophy of Rust/Unsafe Rust.
You’re talking about Steve Klabnik, a guy known for being one of the authors of The Rust Programming Language and the guy who literally ran the @rustlang Twitter account.
Doesn’t change the overall quality of the article ?
Doesn’t change the overall quality of the article ?
I’m sorry, but I’m afraid the article is quite good.
Why? I’m eager to learn.
I like to talk of ‘correctness’ (as in the objective quality) and ‘rigidity’ (subjective; generally better for larger programs and programs that need to be correct, but potentially worse for prototyping and flexibility).
Ultimately, what I care about as a programmer is, if I write/refactor/tweak some code in this language, how many weird edge-cases are ruled out or handled for me? How many unit tests do I have to write, to ensure this myself?
Python is relatively bad at that, even though it’s technically memory-safe, as the post mentions. The dynamic typing, for example, means some refactoring mistakes will just not show, unless you’ve got close to 100% integration test coverage.
So, yeah, I feel like this whole “memory safety” buzzword is lost on pretty much everyone working in a garbage-collected language, even though many of them would be extremely glad about a more correct and/or more rigid language.
Ive never gotten to write rust professionally, but I have always kinda winder d if it was marketed wrong. My thought was always that it should be sold as “easy” though. Its easy to write code. It’s hard(er) to make mistakes.
I kinda figure there’s a bunch of systems programmers with their heads up their asses who would never be caught dead writing in an “easy” language though, so it couldn’t go that way.
(I got bored and started skimming halfway though this article, but it’s neat to hear about up and coming languages I’ll never use at the end)
Ive never gotten to write rust professionally, but I have always kinda winder d if it was marketed wrong. My thought was always that it should be sold as “easy” though. Its easy to write code. It’s hard(er) to make mistakes.
I agree, but I don’t think the problem is marketing. The problem is how some elements of Rust’s community desperately try to upsell the language beyond the value it actually can provide, and once that fails they fall back to toxic behavior and basically just mindlessly shitting on anything that’s not Rust. It goes well beyond a cargo cult mentality, and it’s sad that a fine technology is dragged through the mud by those who were expected to show its value.
- java ( @java@beehaw.org ) 2•7 months ago
Why?
If there just were some link, to some blog post or something, that would expand on the topic… with a tl;dr for the really lazy people… well, that would have been nice…
- java ( @java@beehaw.org ) 2•7 months ago
We’re on a platform, where most posts are links to some blog post or something. So yes, it’d be nice to provide some info other than a generic title and stupid sarcastic comments. You could be useful, but you decided that’d be too much for effort, eh?
TL;DR:
I think that a focus on memory safe languages (MSLs) versus non memory-safe languages is a bit of a red herring. The actual distinction is slightly bigger than that: languages which have defined behavior by default, with a superset where undefined behavior is possible, vs languages which allow for undefined behavior anywhere in your program. Memory safety is an important aspect of this, but it is neccesary, not sufficient. Rust’s marketing has historically focused on memory safety, and I don’t think that was a bad choice, but I do wonder sometimes. Finally, I wonder about the future of the C++ successor langauges in the face of coming legislation around MSLs for government procurement.
You are the least friendly person I have come across from beehaw. You haven’t engaged in good faith, probably haven’t even opened the link, and you have immediately launched into personal attacks.
- java ( @java@beehaw.org ) 2•6 months ago
I asked for details, but got an idiotic sarcastic reply instead. I haven’t signed to be friendly with every moron I meet. If you’re acting hostile, don’t complain that you’re getting the same treatment back.
A sarcastic reply is already much more than you deserved.
- java ( @java@beehaw.org ) 1•6 months ago
Suck my balls, mate.