Hacker News Reader

Comment by emptyparadise | Hacker News Reader

I wonder if Rust can be stripped down (or C can be enhanced) to basically be C with a borrow checker and other safety features? I can live without Cargo or evangelism, but I'd also like to live without CVEs.

View on HN

There are languages like that: https://www.microsoft.com/en-us/research/project/checked-c/

They are doomed to fail. You get all the downsides of not-C with all the downsides of C.

You still pay the cost of losing compatibility with standard compilers, and people with IBM/360 are still mad at you. You still pay the cost of learning borrow-checker-like semantics, and have to convince others to learn your unpopular language.

But you get very little in return. It's still C with its old warts. Whenever safety is the only thing you gain, there's a ton of people like Drew who will tell you it's stupid, because "C can be safe", we've been trying for only 40 years, so it's too soon to give up.

Rust attracts people who need safety, but they stay for the sum types, error handling, hygienic macros, and rich ecosystem.

CHERI (http://cheri-cpu.org) provides a spatially-safe C and C++, and also heap temporal safety (specifically it prevents use-after-reallocation, which is the actual vulnerability, since use-after-free doesn't matter if freed memory is never reallocated). Most code requires few, if any, changes (0.17% LoC in our fork of FreeBSD, which includes the kernel itself and all the low-level runtime libraries), with the changes tending to be due to people conflating pointers and integers (i.e. use uintptr_t not unsigned long/uint64_t for storing a union of a pointer and an integer, or a real union, and use size_t not uintptr_t when you mean a plain integer, though the latter can sometimes still work, just a little less efficiently and likely with some compiler warnings). It doesn't solve the concurrency issues, but unlike CHERI C/C++ those require invasive changes to the language and thus code.

We have a technical report that gives an overview of CHERI and describes how to write good C/C++ that doesn't use dodgy idioms that break in CHERI C/C++ if you're interested at https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-947.html. Arm are also working on a prototype of Armv8-A with CHERI, dubbed Morello: https://www.morello-project.org.

There's checked C [1] as the most recent take on a safer C.

[1] https://www.microsoft.com/en-us/research/project/checked-c/

MISRA C (https://en.wikipedia.org/wiki/MISRA_C) is a stripped-down version of C that is used in critical applications.

MISRA C doesn't include a borrow checker, so it won't stop many memory safety issues. It's just a set of guidelines to discourage you from writing nasty or ambiguous C.

Yes. MISRA C might be a good candidate to add a borrow checker.

I am not terribly familiar with the MISRA C rules, so I am not sure how much borrowing / move semantics is permitted under MISRA C.

That would be cool.

Reply on news.ycombinator.com