50 years of C, the good, the bad and the ugly [video]
streaming.media.ccc.de
streaming.media.ccc.de
I would argue that C++ can be dramatically more deceiving than C --- see inheritance and operator overloading, just to name two.
Note how terrible doing any amount of math is in C.
I don’t understand that. You can have functions that return promises that then can get passed to other functions returning promises, and leave it either to the compiler or to an expression evaluator you write (that ideally runs at compilation time as much as possible) to optimize away anything not needed. For example (pseudo-code)
vector3D a = …
vector3D b = …
promise<vector3D> c = addLazily(a,b)
print c.x
print a.x + b.x
Also, there’s a simple bijection between expressions with operators and two-argument function calls:
a + b * c
+(a, *(b,c))
plus(a, times(b,c))
If you can just extend the types then you can provide operators that way and there's less opportunity for ambiguity. See Rust.
Also so many of the C++ operator overloads are broken instead of just not existing, which tempts you to overload things instead of saying "Nope, that's a bad idea" and just walking away altogether.
Example, boolean short-circuiting AND and OR. If we write
if (this() || that()) foo();
But if the return type used overloads the boolean OR operator, short-circuiting is disabled, and now both this() and that() are always called...
I identify with @antirez's sentiment. I know both C and C++ very well. I find C definitely more artistic. C++ is utilitarian.
Prolog is the other language I code in "artistically". It too is quite simple and constrained, though it is on the opposite end of the high/low-level spectrum as C.
/unpopular-hot-take
I've never used Ruby but from what I've seen I understand it to be similar to Perl in that regard.
Of course good naming and abstractions are of key importance, and comments and inline documentation are important finishing touches, which so many programmers don't seem to have the time for. It doesn't hurt that Larry Wall, the designer of perl, was a linguist. Perl was meant to be flexible and expressive.
And everyone knows that there's nothing worse to read than obfuscated perl. Perhaps some think that is artistic in a different way, to make the shortest and most unreadable program possible. Not my thing, personally.
Only if you ignore
1. variadic arguments as in printf,
2. function pointers which are a very elementary (type-unsafe) form of closures,
3. a nice way of casting to void
4. setjmp and longjmp goodies (?) which allow you to code up co-routine libraries and exception handling mechanisms
I'm sure there are more such facets I am missing.
The elegance of the specification may be questionable, but the scope of what C tried to achieve is breathtaking. It actually is superior to most of its improvements.
Function pointers as an elementary form of closures, come on, what’s next? Closures are defined by capture. It’s nearly as fun as pretending C as coroutines because of setjmp.
How can a statement like C being semantically poor even be seen as controversial? For god sake, we are talking about a language which semantically doesn’t even have proper arrays.
> The elegance of the specification may be questionable, but the scope of what C tried to achieve is breathtaking. It actually is superior to most of its improvements.
Seriously? It wasn’t even a good language when it was released. Lisp and Pascal were far better. It won because of compiler availability and adequate performance on limited platforms.
HN really is a joke sometimes.
The question is about C semantics. Given the reply I get it’s pretty obvious that some here don’t understand what language semantics are. It’s about the amount of concepts you can express in the language. Haskell - a language I personally despise - is semantically very rich. So is modern C++ for what it’s worth. C simply isn’t.
It’s even deceiving sometimes because it has the apparence of having some semantic elements (arrays for exemple) which are not there in reality and are really only syntactic sugar on top of other semantic constructions(pointers).
Also you complain about semantic richness of C, but then only point to semantically rich languages you despise. A curious reader would wonder: why care about semantically rich languages then? An observant reader would wonder: so aren’t there times where semantic richness is not useful?
I’m not even complaining about the semantic richness of C. I’m just stating the fact that it doesn’t really have semantic richness. Then again don’t get me wrong. I do think C is a terrible language and I say that having worked on a C static analyser. It’s full of avoidable undefined behaviours and silly sharp edges.
Thankfully, nice languages with rich semantic exist. I was just pointing some I don’t like to separate the issue of semantic richness from likability. I enjoyed working in Ada a lot. Ocaml is awesome. I have never used Rust but from what I have seen that seems nice.
Semantic richness is useful because it helps programmers express what they want to do in way which are clearer and therefore more likely to be correct.
The successor to Pascal, which fixed it's problems, was Modula-2, which is vastly superior to C. Unfortunately by the time it came out and started becoming available, it was too late for it to compete fairly with C. Ada is comparable to Modula-2, especially before Ada added OOP, but Ada was too late to compete with C as well.
It's taken 30 years but finally we are starting to see safe languages, eg. Rust, compete with C and C++. I don't know whether Rust will be the language that overtakes C and C++, but if not, I believe a successor to it will and C and C++ will become like COBOL, that no ones uses to write any new code.
Many of the so-called issues with Pascal were resolved way back in the mid to late 1980s. In regards to Pascal's competition with C, this arguably evolves around AT&T and Unix. It's AT&T and their huge government, industry, and business influence that pushed C over the top.
One small thing I like about Modula-2 is an improvement in the syntax where BEGIN is not required after conditionals and loops.
The nice thing about C is that if you're opinionated about what you want your ideal language to look like, you can use C in that pursuit. You can write your run-time in C and parts of the implementation. C is good for interfacing with operating system platforms.
You can fully bootstrap yourself off C entirely, or stick with C for the run-time and perhaps other parts. If your language isn't very good at expressing low-level manipulations, you can keep C in there as an option for writing those kinds of modules.
Some languages have used C as a target language for compilation.
C can be an enabler in the pursuit of other languages.
As proven by books like "A book on C" from 1984 (Robert Edward Berry and B. A. E. Meekings).
A lot of what I'm seeing from your comments here is you can't handle people who have something positive to say about C.
They're not saying it's the one true way or something. Just that they like it in some respect.
And your attempts to dismiss that and call "HN" a joke for harboring someone who thinks this way look kind of childish to me.
Considering I was having interesting discussion about the subtleties of the Hindley-Milner type system on this same website a decade ago, yes, I do think HN is becoming a joke. The joke is on me however because apparently I keep commenting for reasons which are not always apparent to me I must confess.
Small example, linked lists. I don't think non-C linked list code tends to be as straightforward as I've seen in C.
Or the character-at-a-time style of string processing. It's kind of unique to C.
You can say there is stuff about that you don't like. That's fine. Linked lists suck with modern CPU caches anyway. C strings have lots of misadventures in terms of buffer overflows. But it's unique and interesting. Lots of elegant things have been written this way. Your unfamiliarity with it doesn't make it "a joke" to point this out.
I have my own gripes with HN. Try mentioning politics and it brings out all sorts of fascist-sympathizing crazies. But saying good to neutral things about C (while not even universally praising it) is not one of those issues.
To be fair, the most straightforward definition of the linked list is generic, and C completely lacks such facility.
> fascist-
Sounds familiar.
Generic linked lists can be done with pointer casts. See the way the Linux kernel does it.
The list manipulation routine takes a pointer to a member, and the more specific type is opaque. The code that knows what the actual structure is can derive it from a node pointer.
A structure can even have multiple node pointers in this scheme.
Template mechanisms cause code bloat and encapsulation violations: having to reveal the entire implementation to the clients so they can instantiate it for whatever type they want.
Some generic mechanisms have dumb restrictions, like you can make a "list of integer", whose elements, sadly, all have to be integers.
In C you can envision what you want genericity to look like at the detailed bit-and-byte memory level, and how you'd like to be able to work with it at the language level, pick some compromises where the two are at odds, and make it happen.
It is false to say that C completely lacks any generic facility because it has union types. Using a union we can put several types into a structure along with a type field which indicates which. We can overlay an integer, character, floating-point number, or pointer to something outside of the node.
I cannot decide whether it's an honor or an insult to be called a _fascist sympathizer_ for opposing the authoritarian suppression of speech.
You are confusing what the language can do and what is semantic is.
C strings are just a contiguous allocation of byte and a bunch of functions which interprets it as ascii characters and stop on a specific value. That’s literally the worst representation of a string you can have.
const char *my_strchr(const char *str, int ch)
{
if (*str == 0)
return NULL;
if (*str == ch)
return str;
return my_strchr(str + 1);
}
Name any other string data structure and I will cite you all the disadvantages compared to the C string.
- If the format contains pointers, you have to marshal it to a flat representation to communicate or store it. The C string is already marshaled.
- If the format contains size fields, their own size matters: are they 16, 32, 64. What byte order? Again, needs marshaling. You might think not if going between two processes on the same machine. But, oops, one is 32 bit the other 64 ...
I shudder to think of what FFIs would look like, if C strings were something else. It's the one easy thing in foreign interfacing.
C programs themselves sometimes come up with alternative string representations, for good reasons; but those representations don't interoperate with anything outside of those programs, or groups of closely related programs.
You are basically arguing that C strings are a good default because they are the default. If they were something else, well, we would have saner FFI in a lot of place.
C strings are a terrible default. They are fundamentally unsafe. Mishandle the null char for any reason and you now face a serious security issue.
Not char/byte C strings. You might be thinking of wchar_t strings.
> Mishandle the null char for any reason and you now face a serious security issue.
With what string data structure can applications peak into and mishandle an implementation detail and not risk creating a security problem?
Same you have a structure with the length and a pointer. Mishandle the length field or pointer and you have a problem.
It certainly is a problem and it's common for C applications to take on responsibilities for manipulating the internals of the string structure.
No I’m talking about the classic byte arrays C pretends are strings. If the receiver you are talking to is not expecting a chain of bytes where each byte is a character and one special value means the chain is over, well, you will have to transform what you are sending to what your receiver is expecting.
"I think C has a lot of features that are very important. The way C handles pointers, for example, was a brilliant innovation; it solved a lot of problems that we had before in data structuring and made the programs look good afterwards. C isn't the perfect language, no language is, but I think it has a lot of virtues, and you can avoid the parts you don't like. I do like C as a language, especially because it blends in with the operating system (if you're using UNIX, for example).
All through my life, I've always used the programming language that blended best with the debugging system and operating system that I'm using. If I had a better debugger for language X, and if X went well with the operating system, I would be using that."
Dec 7, 1993, Computer Literacy Bookshops Interview.
Nobody "worships" C and people who have positive experiences with C often have exposure to higher level languages.
You can find strengths or upsides in C and still acknowledge faults, and still acknowledge merits elsewhere.
We can make a more complicated example that nevertheless uses recursion and essentially the same way, which looks for a UTF-8 character. We can examine and decode a prefix of the string as a UTF-8. If there are bad bytes or the character doesn't match then we recurse.
We can also write a wide character (wchar_t) version of the function which looks the same. That will handle all of Unicode on sane platforms, and the basic multilingual plane (BMP) on Windows.
I wish that C had a more rich way to define struct layouts and low-level representations for integral types.
I really like how Ada does it:
https://en.wikibooks.org/wiki/Ada_Programming/Representation...
If you need to read or write specialized hardware registers, being able to define a data structure with a custom representation is very nice and can save significant time and effort.
Reality though is that we don't have such hardware and we have to deal with it in software, so, instead of a single instruction emitted there will be a bunch of them, and of which there will be certainly branches involved.
For Virgil I chose to settle on 2's complement because it's what hardware gives and has no overhead. It comes with the full compliment of fixed-width integers of widths 1-64 and odd-width ones come with zero-extension or sign-extension as necessary to make the underlying hardware width unobservable.
Yes, and which is exactly what I hinted at with my question to your comment. With the HW we have today, implementing such semantics without an extra hit is not possible and which is why I thought your comment wasn't completely fair but coming from more theoretical stance.
I suppose range analysis can eliminate many overflow checks, e.g. in counted loops, but it's not completely zero cost.
Yes, but now as well you have to return a value to communicate the overflow to the call site. And call site has to check for that value and that's yet another and another ... and another branch. Depends how deeply you want to propagate that error and decide how (?) to deal with it, this will grow the code size, which can contribute to the higher frequency of I-cache misses and page-faults, but it can also inhibit compiler optimizations.
On the CPU level, I think there also could be an attached cost as well in case some of those branches end up as entries either in branch-target (BTB) or branch-order (BOB) buffers or both. Sizes of these buffers are quite scarce so ending up with the unfavorable ratio of check-for-overflow entries vs entries occupied by other type of branches found in the code is something that will put more pressure to our branch-prediction unit. More "important" branches will now more frequently start to lack their entry in the branch history simply because of the fact that we started sprinkling check-for-overflow branches. And yet we know that branch misprediction is the costliest operation (15-20 cycles) we can encounter in the CPU pipeline.
Also, I think a bigger picture must be observed in this context. E.g. what is the percentage of arithmetic operations some big real-world sized binaries contain? I'd figure that in average it would be a sizeable amount, and in ones with a lot of math even more so. And then I wonder what we could observe if we applied the check-for-overflow transformation to all such signed-arithmetic operations.
I'm aware that there are some artificial benchmarks showing that there's no cost attached to branches which are essentially never taken but it makes me wonder if that cost would really be zero if we exercised that change on the actual code instead. For at least the reasons from above.
What "old ideal" ? Where do you believe this "ideal" was expressed? Should I expect to find it in the First Edition K&R perhaps? Or in the documentation for the original C compiler? In the ANSI standard ?
C was never this mythical "portable assembly language" that's just something people say about it, mostly to ridicule it, you are engaging in Nostalgia.
"The language is also widely used as an intermediate representation (essentially, as a portable assembly language) for a wide variety of compilers, both for direct descendents like C++, and independent languages like Modula 3 [Nelson 91] and Eiffel [Meyer 88]. "
If they are right or not, it is another matter.
The books you have are excellent ways to learn the language, and this one complements them in that it lists common practices around, for example, error handling, and other common topics. It shows different approaches and mentions practices from real-world open-source C projects that follow them.
It seems like a good book to continue exploring C after learning the language.
I worked with Objective-C in the late 90s and again in the 2010s, which is basically C with funky object stuff.
I don't miss it at all. C is very low level and so easy to write bad code in if you don't have solid discipline, the language doesn't help at all, which was not really a design decision back then. The first C compiler we used didn't even support prototypes.
I exclusively use Swift now.
Surely you mean C89, where functions have some type safety but C’s variable declaration syntax remains a horrible inelegant kludge?
Have you written much code in Swift?
I assume you're being facetious with the "recently came across", since scipy is so common, but I will add that nearly every math-intense library is a clever wrapper for some Fortran code.
I would be perfectly happy to see many hardened C libraries become the foundation of the next gen systems/ embedded languages. It does bother me slightly when we abandon the past entirely and attempt to "rewrite it in X"
But just like Fortran is still used for nearly every math-intense library, mostly invisible for most of the users, I suspect that C will still be around in 50 years from now.
I agree, with his observation that C should be no longer your language of choice for new projects. I personally still prefer using C/C++ for my private software projects, simply because it is the language I am most fluent in. This year I used it for AoC.
It's almost the exact opposite extreme on the pendulum, where C allowed anything while Rust limits to only what the language designers conceive as proper and not just safe.
Zig can gain memory management systems like Nim's ARC which works well for system design and adds temporal safety. On the other hand Rust's trait system likely will never become an "open ended" type system like say Julia's. Heck, even overloaded function types don't seem likely in Rust.
Though, it looks like Zig doesn't do function overloading either [1]. That's a disappointment. So you end up with `array_count`, `map_count`, etc instead of just `count`. In my way of thinking that's more work reduces readability. It's one of the paint points of C vs C++ to need `array_list_count` and `hash_map_add` instead of just saying `vec.insert(...)`.
The biggest ones for me in Rust is that it disallows extending traits for types you don't own, and the lack of function overloading. Neither of those are required for the borrow checker or safety, but it's a philosophical design decision.
Zig doesn't have function overloading but it does have namespaced functions, so you can define your types and your "methods" on them.
Another issue with function overloading is that it can make code more difficult to debug. If a bug is found in one of the overloaded functions, it can be difficult to determine which function is causing the issue. This can make it more time-consuming to fix the bug and can lead to frustration for the developer. I remember debugging an issue at OkCupid and we lost many hours due to debug information being collapsed for overloads, making it look like the wrong function was being called in the debugger.
Finally, function overloading can lead to code that is more prone to errors. When the same function name is used for multiple different purposes, it can be easy to accidentally call the wrong function with the wrong arguments, which can lead to unintended consequences or runtime errors.
In conclusion, good riddance. This is what makes Zig a great language, that it doesn't have garbage like function overloading.
This is a similar argument to Hungarian encoding, IMHO. A decent LSP makes it trivial to see which function is being called. The other issue you mention is a problem with the debugger/compiler, not function overloading.
> Even finding what file the function is in can be a non-trivial task.
Not really, control-click and you’re at the function def.
> it can be difficult to determine which function is causing the issue. This can make it more time-consuming to fix the bug and can lead to frustration for the developer.
Not any harder than “method” overloads, which it sounds like Zig does have.
Personally I find the opposite. Having 20 names for functions that all equate to `len` requires more mental overhead.
We're talking about replacing C here. Requiring everyone depend on a hefty LSP to make sense of source code is a big ask.
Source code is text. I firmly believe that all semantic information of a piece of source code should be expressed as text in said piece of code. I already see code where the language allows the programmer to omit types from variables for 'brevity', and the assumption then is that everyone working on that code is using a fancy enough text editor that can stick in extra labels to show the missing type information. Absolutely baffling to me how people find that acceptable in any way.
The orphan rules are definitely necessary for coherence: otherwise, you could end up with a situation where two different crates try to implement the same trait for the same type, and there would have to be some (likely unwieldy) mechanism to resolve that.
Also, it's not that you can't implement any traits for types you don't own, it's that you can't implement traits you don't own for types you don't own. So you can still, e.g., create your own extension trait and implement it for whatever type you want. (But you can't do that while also creating a blanket impl for types implementing the original trait, which is a bit of a pain.) And, of course, if you need an object to implement a trait you don't own, you can define a newtype wrapper over it, but that can also be difficult to work with sometimes.
Perhaps this situation could be improved by one of the "crate-local impl" proposals that have been floating around. I'm not entirely sure how those would interact with existing implementation from the defining crates.
I think Julia, D, Nim, and others show its possible and generally easy to work with open ended type systems. I think Haskell does as well?
Though yes those come at the cost of possible conflict or user confusion, which is why I consider it a philosophical decision. It matches with the decision to not allow user code to use trait specializations in stable despite the stdlib having it.
Imports generally seem fine for controlling what gets used. Want a trait impl, import it into a module. Cargo crate features might also be a route to enforce package level decisions.
> And, of course, if you need an object to implement a trait you don't own, you can define a newtype wrapper over it, but that can also be difficult to work with sometimes.
Unfortunately that means you can't define 'default' or 'clone' traits for a type. That prevents you from using derives on your newtypes as well. That means manually implementing clone, or serde which is a PITA.
> Perhaps this situation could be improved by one of the "crate-local impl" proposals that have been floating around.
At least that'd make it somewhat easier to work with. It'd still not let end users / programmers to mix and match types and traits from different libraries without a lot of unnecessary work.
Sorry, could you give an example of this? I can't find any way to extend existing types in those languages with some brief Googling.
> It matches with the decision to not allow user code to use trait specializations in stable despite the stdlib having it.
Keeping specialization unstable is much more a practical decision than a philosophical position: if they could, they would've stabilized it years ago. The problem is that specialization very quickly becomes unsound in combination with lifetimes. The compiler erases all lifetimes on types after checking them, since monomorphizing a new type for each lifetime would lead to an exponential explosion (this can't be changed at this point without redesigning the language). Therefore, users must not be able to specialize a trait impl on certain lifetime combinations (or certain lifetimes like 'static), since the compiler would have absolutely no way to tell which impl to use. And in turn, completely barring lifetime specialization becomes a daunting challenge with the existence of associated type projections and blanket impls. Specialization definitely isn't kept unstable just because they think users can't be trusted with it.
> Imports generally seem fine for controlling what gets used. Want a trait impl, import it into a module.
I don't think this would be compatible with blanket impls, since you couldn't just import every single potential impl in existence (and if you could, you'd run into conflicts). I suppose you could have a system of exporting impls, where to use a blanket impl you have to pass it another impl as input, but at that point you have new idiosyncratic system that would scare away users and would likely be far more noisy than a good newtype system.
> Unfortunately that means you can't define 'default' or 'clone' traits for a type. That prevents you from using derives on your newtypes as well. That means manually implementing clone, or serde which is a PITA.
If a foreign crate doesn't implement Default or Clone for its types, then how is the compiler supposed to derive it for your local newtypes? It can't just look into the foreign type's fields, if they aren't all public. Are you often having to work with fully public foreign types?
Overall, I get that the type system can be pretty frustrating as it stands today, but I don't see any better alternative than building better tools for defining newtypes.
- Swift has plans to incorporate temporal safety in upcoming releases. - Zig isn’t fully baked yet.
Rust will be king of that space for a while, though.
Rust does not have a defined standard yet, but I suspect it also would be quite large.
Alongside RAII for resource management.
Not exclusively in C, not anymore: https://docs.kernel.org/rust/index.html
It might take another decade for a C-free build to be possible, though.
Rewriting that amount of code in ten years sounds very very hard, at least.
Now, rewriting everything, including all the legacy drivers? Yeah, never happening even if Rust succeeds utterly.
I wish something like it could happen, but I am causyiously optimistic.
A potential strategy would be to set a date where any new drivers must be written in Rust. Deprecate every non-Rust driver on a date after that. Focus on rewriting only the drivers necessary for current hardware platforms (and some sensible/arbitrary cut-off going back x years). Then set a final deadline for a New Linux kernel release that removes all deprecated/C drivers.
I would blindly estimate that entire process to take 10-20 years (not including the time needed for debating the whole thing).
Then somebody "just" needs to rewrite the rest of the code.
So, uh, any volunteers?
AFAIK Torvalds has also stipulated that any Rust code needs to be mirrored in C.
Do you have a cite for this? I hadn't heard this at all.
FWIW that's not the same thing? That's simply CONFIG_RUST=n, not "You have to write this driver twice in two different languages".
https://github.com/bjorn3/rustc_codegen_cranelift
The compiler frontend is already written in Rust.
Let's say it would avoid all the memory bugs in LLVM, that would doubtlessly make it worth throwing away the LLVM implementation (avoid sunk cost fallacy).
Namely, if it has to be "replaced", that would be with something with a much simpler syntax, which will require a bit more of finger power. We don't want to find ourself locked-in by very few compiler vendors (open source or not), that only because it is not reasonable to code a real-life alternative with a small team of averagely skilled devs in a reasonable amount of time.
This language should build on C though: no enum/typedef/_generic/switch/etc, only 1 loop keyword (loop{}) only explicit sized types, no integer promotion, no implicit casts (except maybe void* pointers but number literal casts should be) but explicit casts (compile-time and runtime, without that horrible c++ syntax), explicit compile-time const (we have only runtime consts which could be optimized as compile-time consts), enforce extern for functions (and don't try to put the binary format, elf/coff/etc, semantics into the language syntax or worse, the OS interface semantics), etc.
With enough discipline (and compiler warnings), we could get close to such language.
I did not check the latest and greatest rust syntax, but is what's above its explicit goals?
That said, I am a "everything in 64bits RISC-V assembly with x86_64/arm64 legacy ports kind of guy"... if RISC-V is successful (I wish). We could think of high-level language interpreters (coded in assembly, for instance a RISC-V coded python/lua/javascript/etc interpreters).
The "benchmark" to run to evaluate syntax complexity toxicity, for a compiled language, is how long an alternative compiler written by a small teams of averagely skilled devs, or even one individual averagely skilled dev, can stay a "real life" "working" alternative.
Mid-term/long-term planned obsolescence of computer language syntax is really...
Oh, and in my previous post: for compile time constants we can use static consts, my bad.
And something must be done about breaking changes of the syntax (or any never ending "features" additions).
We all know that some syntaxic constructs will be nasty in the end and will reasonably need fixing (basically, to keep them excrusiatingly simple from a compiler writing point of view). I am thinking about something like "syntax breakage provisions" from the language authors: for instance, no more than 4 iterations of major syntax breakages, then the language syntax will be frozen for forever.
Whatever, I am a everything in assembly kind of guy (with high-level language interpreters written themselves in assembly).
All that is a thought experiment for me, nothing more.
Or maybe they will, given how much consultants in those languages happen to be paid, as no one else wants to touch them.
I do dream about that. Just being able to tag along while some programmers learn their Xth framework as a language.
Maybe someday I might concede and move on from C89 to C99.
I don't think there is any reason to choose C89 over C11 other than fear of new compiler bugs and compatibility with old compilers?
That's an extraordinary claim indeed; if people outside tech were going to call bullshit on EULAs as a liability shield, they would've done so in the last 50 years of software sales.
Reliability or the lack thereof has never been an impediment to some piece of software getting popular, but to me, you appear to believe that people want more reliability from software than they have been getting thus far.
Your belief is at odds with reality.
- Return of goods in digital stores
- Warranties in consulting projects, requiring free of charge fixes up to one year
- Cybersecurity bills
It will only get better from now onwards.
One reason for C to disappear completely would be if computer architectures would change so much that current programming languages no longer even map to those new architectures (e.g. all the existing programming languages would need to be dumped anyway).
> The Lindy effect (also known as Lindy's Law[1]) is a theorized phenomenon by which the future life expectancy of some non-perishable things, like a technology or an idea, is proportional to their current age. Thus, the Lindy effect proposes the longer a period something has survived to exist or be used in the present, the longer its remaining life expectancy.
The speaker discourages C for new projects, but that says more about the problem domains they work in than C itself. C is what it is because the hardware and assembly language are what they are. Folks who want a safer C should design a new hardware architecture with a "safe" assembly language and a new low-level language that targets it.
It's a massive red flag that they don't know enough to be useful.
C is great for the things C is great for, however small that range may or may not be now and in the future.
Any other stance is reductive and misleading.
I’ve been writing C since 1991 and I can’t think of anything where I wouldn’t start a new project in some other language. There are many interesting choices of varying maturity in the low-level systems programming space: Zig, Rust, Crystal, D, Swift (if the standard library ever gains support for system-level programming). Even the “better C” subset of C++ will allow you to avoid certain classes of security bugs completely.
I don’t think C is even merely adequate for anything at this point; defaulting to memory safety is table stakes in any domain where C was once dominant.
There.
If I use a micro controller to control a string of leds I do not care about security/memory safety. But I do care about being as close to the metal as possible, and being able to understand the compiled code.
But many microcontrollers these days will likely have a TCP/IP stack, perhaps even crypto, even if it is to control a string of LEDs via MQTT or Modbus TCP.
Give you another example. A watch, not an apple watch, but a simple Casio watch. One that does time, alarm and a stopwatch. Not connected to anything. What is important here is the battery life, so the less code the better. C would be a fine choice here. All additional code to prevent security breaches would be a complete waste here.
Give another example. As my day-job I develop embedded software for the railways. Current system I work on operates the brakes when the train goes too fast. Not connected to the internet, and no connection would even be allowed. Written in C. One because it is simple to understand and the developer can focus on getting the functionality correct. Secondly because there is a wide choice of additional tooling and standards that is required to get the application certified.
There are plenty of things that are controlled by a micro controllers that do not have a network connection.
A micro controller hitting a memory safety bug that causes the LEDs to present invalid output can have real world consequences. Even if the micro controller isn't directly actuating machinery, it might cause an operator to incorrectly act because they were mislead.
If the micro controller is running Christmas lights, it might be fine if it falls over, no one will die, but I would still call that a manufacturing defect.
Thankfully returns in digital stores, warranties in consulting projects, lawsuits in business losses and cybersecurity bills are slowly changing that.
Writing readable code. I'm a huge fan of Zig and Rust too but at the end of the day they just aren't C.
Rust is exciting and proving itself about as rapidly as such a language could be expected to do. But there are big questions around how all of this plays out in a long-lived project. There's a good argument that C's simplicity is an asset here.
I like Rust a lot and have done some cool stuff with it. I believe the challenges of long-lived projects will be solved. But at the same time, I admit that there are a lot of other factors (including non-trchnical ones). If you pick a language that doesn't last for whatever reason, and you have a couple decades worth of code, the options are grim.
Implementing low-level code that is important enough to prove correct, without going through the additional effort of de novo proving your entire toolchain is correct.
It's really not, though. What C is an abstraction of is computer architecture as it existed by the late 1960s.
I don't follow. Barring micro-code, hardware is designed for executing either RISC or CISC instructions. If anything, the industry has matured and we see less esoteric ISA's today than in the 1960s.
Would that be LLVM's IR or MLIR (https://mlir.llvm.org)?
Unfortunately it's an industry with a lot of stubborn old people so I don't see any major changes happening until they've retired but I'm willing to bet that async is going to revolutionize embedded development. Being able to await interrupts and doing efficient cooperative scheduling while writing straight forward code is a massive QoL improvement which is what embassy is enabling: https://embassy.dev/
There are surelly other factors that weight in using C, but not for lack of options (in many cases).
Unfortunately Ada is held back by a genuine lack of awareness and some old misinformation baggage.
It's a good thing more people are realizing we really need to stop settling for C and C++, stop investing more money into tools that simply compensate for the weak foundation of those languages, and finally adopt safer alternatives.
People normally think that C is the best for low level embedded programing, but from my experience, it pales in comparison to the amount of low level control and type safety that Ada provides, even when you restrict yourself to a small subset of the language (note: Ada is often used on barebone systems and without an Ada runtime). Given the interoperability Ada has with C, it means you don't have to rewrite everything in order to incorporate it into existing code bases.
C does have a similar kind of niche at first glance: systems programming is of course conservative, rewriting everything is unlikely, and of course, C is the language used for ABI. Except on closer inspection, that moat is remarkably shallow. Being the language of ABI means that every competitor language has some way to speak C guaranteed, so the friction of rewriting systems software Ship-of-Theseus-style is much lower (though still nonzero). Systems software is rewritten from scratch on a much higher cadence: in the last 20 years or so, most of the userspace system glue for Linux has been replaced (e.g., systemd, iproute2, pulseaudio, wayland). And we've learned over the past few decades that there's no practical way to fix C's fundamental unsafety issues with software engineering practices, and C's committee is too conservative to consider retrofitting the necessary features to be able to fix unsafety at a language level (to say nothing of getting people to use it).
There is already a small clutch of languages that can serve C's niches that don't have the same fundamental unsafety issues, and right now, we're sort of at an experimental stage of system software trying them out. It's not unreasonable to believe that within a decade or so, one or more of these languages would be considered a standard, safe choice for implementing new systems software--and the use of C in new projects will start dropping. At some point, the proliferation of non-C systems projects will make people point out that having these components talk through C's ABI is too limited in functionality, and a system will change its ABI from C to some other language. And once it is no longer the language of ABI, C will lack its moat that keeps it alive, and it will start dying, though its death will be a slow, agonizing death.
SciPy is a highly optimized library and Fortran is faster than C for some tasks:
If anything, C may still be going strong for another 20 to 30 years.
The language has a few irritating historical artefacts and the stdlib API is completely outdated and full of bad design, but there it is still versatile enough for my needs.
It is also completely unnecessary on Linux. I switched to freestanding C and discovered it was a much better language. Made programming fun again. All I needed was one system call function and some entry point code.
It's gotten to the point that it bothers me that gcc could potentially generate calls to mem* functions even in freestanding mode.
https://www.schneier.com/blog/archives/2007/09/the_multics_o...
"Multics B2 Security Evaluation"
https://multicians.org/b2.html
But naturally ignoring it was more fun,
> Although we entertained occasional thoughts about implementing one of the major languages of the time like Fortran, PL/I, or Algol 68, such a project seemed hopelessly large for our resources: much simpler and smaller tools were called for. All these languages influenced our work, but it was more fun to do things on our own.
>"if you want to write new program in C now think long and hard and pick something else"
I would not use plain C to write enterprise backend servers. I happily use modern C++ for that.
For some very low power microcontrollers however I absolutely would. Amount of high quality free tooling and libraries beats everything else.
From a practical point of view: I've written enough firmware for very lowly microcontrollers like AT90USB1286. Runs like a charm (oldest for 10 years already), did not not require even single bug related update and zero complaints from customers. Changing the language in this particular case would bring no benefits but extra expense.
I tend to think unless perform/$ is really important one should use a managed language for that, that isn't Javascript.
But yeah, not really sure what some other language would buy me in the small embedded space that earns me my beer money. I recently had an issue where the corporate spyware was convinced make/gcc were up to no good resulting in minute and a half compile times instead of the usual 10 seconds. I spent a bunch of time with IT getting that fixed. Well that's the build time I'd get with Rust. So Rust is a big nope. C++ is not that slow but still slow. And C++ without malloc is well who are we trying to kid here.
For my particular project managed language would simply not work. Way too slow. Besides the code base is relatively small and higher level language would not offer any compelling benefits.
>"minute and a half compile times"
Just checked. My particular project compiles under 1 second using Atmel Studio 7.
You simply have to build or use a different framework offering similar or better APIs.
It feels like it's the best way I want to do this. That way, a C compiler can do a lot of work I really don't want to do, C already has backends, optimizers, etc etc.
All I want is a C-like language with native strings, hash map and list, tuples python indentation, vector math, and nothing else, and make it as simple as possible.
I'm a bit tired of new language trying to do new things, I just want something less verbose than C, but not as powerful as C++, with the feeling of python.
They're great languages, but they're not what I want.
So, go for it, and keep us updated on your progress. Good luck.
It's close to what I want to do, except it doesn't have python indentation, and it doesn't have tuples.
Even Petzold embraced C++, even if superficially,
"This third edition has several changes. First, all programs are now compilable with either the Microsoft or the Borland compiler. All make files are generic and use environment variables for compiler flags, link libraries, and so forth. Second, all programs are now compilable in C++ mode. Although I don’t use any C++ specific features, compiling first in C++ mode is helpful if C++ features are to be added later to the code"
-- https://archive.org/details/programming-windows-31-3rd-ed/pa...
Veiled insult noted ;)
I used both, but TurboC was a real game changer for me. I came from the ST using MWC and ended up in very unfamiliar territory on Windows, Borland TurboC made all the difference for me. It allowed me to be productive on an unfamiliar platform, compiles were absolutely lightning fast compared to anything the competition put out and was rock solid.
Edit: I just realized I still have ctrl-f9 more or less in my muscle memory. It's been decades...
Happy New Year by the way, if you are still up and reading this!
C without undefined behaviors is not C anymore by the way. It would be something else.
It is not hard to say what is unique about C: it and Forth are the only high level languages with seamless access to memory. If other languages offer it at all, like PEEK and POKE and Basic, it is far more awkward and interrupts your flow. That might be a good thing - the ESPOL compiler mentioned in the talk would print a big fat warning "YOU MUST KNOW WHAT YOU ARE DOING!" after any line in your code doing C-like tricks.
He goes on to list the following options (and says C++ does not count), but we'll only know far in the future which would have been the right pick:
- Rust
- Go
- Zig
- V
- Nim
- Swift
- ...
So while a security conscious group can write C++ code that takes advantage of those features, other group can basically compile C++ code that is hardly any different from C.
So it is a better option than raw C, if it is the only viable alternative (like in HPC), but for security conscious scenarios one of the others is a better answer, if available.
Nothing compares to the raw power and control we get with C.
Around '97-98 Java was all the rage. Then Bill Gates did his internet pivot and we had .NET arriving in the '00s. The allure of being able to program in any framework language and interoperate looked like a good thing.
Over the last 20+ years I had been in the .NET world and just this year I went back to writing in C and it all came back. It is quite refreshing to be completely responsible for every aspect of your code's working. While it is sometimes tedious, nothing beats the power and control of working close to the machine abstraction.
Just my 2cents.