Hacker News Reader

Comment by 9rx | Hacker News Reader

> Nil exists in C and is widely considered to be a massive mistake in the language.

You're almost there, but it is wildly considered to be massive mistake in context of arrays. C has weird array semantics that are confusing and hard to get right, even for seasoned developers. That is where NULL comes to bite people time and time again. Go did not inherit C's arrays. Neither did Javascript. They go out of their way to avoid what C did. In Go, you can come close to the same semantics if you use the unsafe package, but take note the name.

Yes, they still have nil, but the scope is tightly constrained and while it is technically possible to misuse, you have to try pretty hard to do so. There are many other things that are more likely to end up being misused. Those would be the more massive mistakes.

> But Go could have been better.

Obviously. Every language ever created can be better.

View on HN

> You're almost there, but it is wildly considered to be massive mistake in context of arrays.

From Tony Hoare: "I call it my billion-dollar mistake. It was the invention of the null reference in 1965. At that time, I was designing the first comprehensive type system for references in an object-oriented language (ALGOL W). My goal was to ensure that all use of references should be absolutely safe, with checking performed automatically by the compiler. But I couldn't resist the temptation to put in a null reference, simply because it was so easy to implement. This has led to innumerable errors, vulnerabilities, and system crashes, which have probably caused a billion dollars of pain and damage in the last forty years."

Odd that he wouldn't mention the word "array" anywhere in that quote.

> Yes, they still have nil, but the scope is tightly constrained and while it is technically possible to misuse, you have to try pretty hard to do so.

Like by not remembering to check if a pointer is nil? Or actually comparing one typed nil to a different typed nil?

> Obviously. Every language ever created can be better.

Only one of us is arguing that reimplementing C’s mistakes is actually a good thing.

> Like by not remembering to check if a pointer is nil?

Rule of thumb is to not introduce values that aren't valid. Equally, don't put in -1 for an age value, even if the language allows you to. You might later forget to validate that the age value is valid.

Yes, mistakes are possible, but these types of mistakes are pretty rare. There is some value in eliminating the possibility of those mistakes, sure, but we cannot pretend that it comes cost-free. There is good reason why almost nobody uses Rocq.

> Or actually comparing one typed nil to a different typed nil?

This is something that is likely to confuse, but not a facet of nil. It is related to interfaces. Let's not flail around like one of those wacky blow up things at the used auto lot.

Ah the good old “just be a perfect programmer and you won’t run into any issues” argument. Haven’t heard that one in awhile.

If only you had made it to the second paragraph.

Hey, at least we can now understand why you have such a hard time with nil, so that's something.

Your second paragraph doesn't hold after one minute spent reading the CVEs list.

Nil references in Go aren't likely to be a source of CVEs. Dereferencing a nil reference is not undefined behavior in Go; it's guaranteed to panic.

Not all CVEs are RCE. This one[1] for instance is go's nil-dereference caused.

[1] https://access.redhat.com/security/cve/cve-2025-29785

This is a bug that could also happen in Rust if someone used 'unwrap', or if the code panicked for any other reason. You can have logic bugs in any language. Remember the Cloudflare outage of Nov 2025.

It's also worth noting that the vulnerability you link to is a denial of service vulnerability. While yes, this is technically a vulnerability, it's not the sort of thing that people are usually worrying about in the context of null pointers. If features that give rise to DoS vulnerabilities are the ones to worry about, top of the list would have to be backtracking regex engines: https://owasp.org/www-community/attacks/Regular_expression_D...

Reply on news.ycombinator.com