Hacker News Reader

Comment by junon | Hacker News Reader

I love C. I'm good at C. I have extensively researched undefined behavior, how to spot it, how to avoid it. I've written loads of C, and I consider my C to be pretty darn good.

I learned Rust over the last 6 months. I'm not sure I'll ever go back to C. I still love C. But Rust is the future. I'm pretty sure of it. I don't have to worry about undefined behavior unless I opt into it, and I usually write more performant and powerful code in a shorter amount of time.

I've gone down the road of trying to bolt on checkers and verification to C to achieve a better DX when writing safe C. C compilers just aren't extensible enough right now though (Clang would require some serious upgrades to the attributes and tablegen system in order for it to work well).

Rust's compiler is already extensible today, and the language has most of that built in.

View on HN

Have you tried zig?

I've experimented and liked it, but the odds of a language exploding in popularity without a massive investment from tech giants is nearly zero. It's not "may the best language win."

Yes. I'll leave it at I have serious concerns about the safety of Zig and refuse to use the language or anything written with it until its creator changes his approach when responding to critical security vulnerability reports.

You have no idea what you are talking about.

I would love some context from either parent commenter here. This is the first I've heard of security concerns with zig, though admittedly I don't use it much.

https://news.ycombinator.com/threads?id=_u9xp (which appears to be junon?) I'm guessing, keeps popping up when Zig is mentioned.

Yes, I asked Dang to remove them after a conversation with Andy, as I wanted to reconcile this with him privately. Dang said he wouldn't remove the comments but would anonymize them, which I guess results in that username.

It's not really something I want to bring up again. I was asked my opinions on Zig, I gave them. The PR might not have been the 'best' solution but the vulnerability was left unaddressed - Andrew seems to insist I misunderstood something, but has failed several times to explain why.

I hope it's since been fixed, but panicking on UTF-8 decoding errors had the potential for massive damage in my opinion.

Andrew, you've taken this road for years now and have only been rude and dismissive to me on Discord, IRC and GitHub for a while, despite my many attempts to reach common ground and discuss what happened with the DOS vulnerability I found in the standard library, one you acknowledged was unfortunate. You dismissed it saying that Zig should not be used in production until v1, but I (correctly) pointed out that won't stop people from using it in production. Now, for example, we have Bun.sh, which worries me that the standard library has other "unfortunate" vulnerabilities you have also chosen to ignore that are making their way into production.

There's clearly nothing more I can say to you; I'm tired of the emotional and childish responses to my attempts to reach out. I've expressly avoided using your name and have tried to keep my critiques civil when discussing Zig the few times I have. However, you seem to find the comments every time despite this.

I wish you and Zig the best of luck.

---

andrewrk — 04/02/2020 there's no such thing as security vulnerabilities until post-1.0, which is why nobody should be using zig in production yet

Reply on news.ycombinator.com