Hacker News Reader

Comment by VWWHFSfQ | Hacker News Reader

Yep and like I said, I'm interested in Zig. But it's still somewhat discouraging as a C replacement just because it seems to still have all the same problems but without the decades of tools and static analyzers to help out. But I'm keeping an eye on it.

View on HN

It is my opinion that even if Zig were nothing more than a syntactical tweak of C, it would be preferable over C. C has a lot of legacy cruft that can't go away, and decades of software built with poor practices and habits. The status-quo in Zig is evolving to help mitigate these issues. One obvious example that sets Zig apart from C is error handling built into the language itself.

What specific legacy cruft does bother you? I think it is a strength of C that it evolves it slowly and code from decades ago will still run.

I also do not see how having decades of legacy software is holding anybody back doing new stuff in C in a better way. New C code can be very nice.

So slowly that what allowed for Morris worm is still present in C23, and now everyone is rushing into hardware memory tagging as a solution instead.

Can you be more precise? Memory safety does not only affect C programs and - despite people repeating this over and over - I do not believe it is true that it is actually harder to build safe programs in C compared to many other languages. Ada and Rust have certainly some advantage, but I think also this is exaggerated.

Memory corruption caused by lack of bounds checking, or vocabulary types like the ones provided by SDS and glib.

Microsoft had to come up with SAL during Windows XP SP2, Apple with -fbounds-safety alongside Safe C dialect for iBoot firmware, Oracle with ADI on Solaris/SPARC, Apple's ARM PAC extension, ARM and Microsoft's collaboration on Pluton and CHERI Morello, Apple, Microsoft, Google and Samsung's collaboration on ARM's MTE.

Lots of money being spent on R&D, for something WG14 considers exaggerated.

Those extensions are mostly to be able to enhance safety of legacy code though and not necessary when writing new code that is safe. But it is only the later that is relevant when comparing to new alternative languages.

Where can we find examples of such newly written C code that is memory safe, given that language features that would make it possible are only now under discussion for future standards, after governments and industry pressure?

Basically any code that does not use pointer arithmetic or raw pointer dereferences and instead puts string handling and buffer management behind abstractions.

The new feature we will put in are not to enable safe programming, but to make it more convenient and to make safety demonstrable.

And I wish there was actually some real industry interest to pushing this forward. Industry seems more interested into claiming this an unfixable problem and we all have to switch to Rust, which gives them another decade of punting the problems with existing code.

So basically no examples, just hope people actually follow best practices, as usual.

Why doesn't WG14 prove the industry wrong then?

I could help with searching some public examples if you really do not know any code that uses safe string abstractions in C. But my original aim was to understand what specific "legacy cruft" in C is seen as problematic, and why its presence requires an entirely language to fix. So far, I did not get a good answer to this. I certainly do know some legacy cruft I want to see go but its presence does not prevent me from writing bounds-safe code.

WG14 is a very small number of volunteers. It would help if the industry would actually invest development resources for safety on the compiler / language side and in cleaning up legacy code.

Exactly, there are very few pearls of best practices in C, and those that exist, are probably in high integrity computing, with the relevant certification costs.

When all major OS vendors, some of whom are also compiler vendors, see more return into investment, contributing their money to alternative language foundations, or open source projects, than sending their employees to either WG14, or WG21, it is kind of clear ISO isn't going the way they would like to.

I would not call this an exaggeration, rather not listening.

Additionally, it would not surprise me if one of Zig, Odin, Rust eventually started popping up on console DevKits, or Khronos standards as well.

I don't know. WG21 is very big. WG14 is very small, so it is different. But in neither there is ISO going in some direction. Whoever shows up can influence the standard. Some of my proposals towards safety were opposed by compiler vendors because they do not want to put up too much pressure on their customer upgrading their legacy code. But of course, rewriting the code in another language would be much more effort than maintaining it... So I think the true answer is that nobody want to invest in maintenance of legacy code. But this will increasingly also be a problem for other languages once they are not young anymore.

Maybe people should take advantage D, Ada and Modula-2 are all part of GCC.

Im pretty sure valgrind and friends can be used in zig.

Zig is still not 1.0, theres not much stability guarantees, making something like Frama-C, even tho it is possible is simply going to be soo much pain due to constant breakages as compared to something like C.

But it is not impossible and there have been demos of refinement type checkers https://github.com/ityonemo/clr

Beyond that, tools like antithesis https://antithesis.com/ exist that can be used for checking bugs. [ I dont have any experience with it. ]

What's the state of the art here?

Most of Zig's safety, or lack thereof, seems inherent to allowing manual memory management, and at least comparable to its "C replacement" peers (Odin, C3, etc).

I guess formal verification tools? That is the peak that even rust is trying to reach with creusot and friends. Ada has support for it using Spark subset [which can use why3 or have you write the proofs in coq] Frama-C exists for C. Astree exists for C++ but i dont think lone developers can access it. But it is used in Boeing.

Comparable to Modula-2 and Object Pascal, hence why those languages ought to do better.

Otherwise it is like getting Modula-2 from 1978, but with C like syntax, because curly bracket must be.

No shame in waiting until 1.0. There's other production ready languages you can use right now so you can ignore Zig until then.

Reply on news.ycombinator.com