apardoe-MSFT

Hi, I'm the guy who wrote the original VCBlog post. I would assert that we've been consistent in our messaging: there is not an automatic fix available for Spectre. The /Qspectre switch offers help in mitigation. It doesn't offer, nor does it claim to offer, complete protection.

We--as an industry--are learning as we go with Spectre. There's a lot of data that went into the decision to release this switch with its current implementation. And this isn't the last iteration: note in Paul Kocher's writeup that we've asked for feedback as to whether anyone would use a switch that was sound (for known variants) but incurred very large performance regressions.

As evidence that this is an industry-wide issue, I ask that you reread Paul Kocher's post. Also, see Chandler Carruth's tweet this morning about this topic: https://twitter.com/chandlerc1024/status/963995521705627648. Chandler is the guy driving Spectre in LLVM.

Lastly, understand that Microsoft has a lot of customers who rely on our technologies. For their benefit it's often better to say less than to say more, especially when talking about security vulnerabilities.

"Managed memory is free. Not as in free beer, as in free puppy."

Dev manager of Exchange used that line in a talk. Never were more insightful words spoken. Devs will move from C++ where they obsess about every allocation to .NET and they'll totally forget that allocation is expensive no matter what the platform or runtime.

Having worked for 7 years on the .NET runtime team, I can attest that the BOTR is the official reference. It was created as documentation for the engineering team, by the engineering team. And it was (supposed to be) kept up to date any time a new feature was added or changed.

Coercion is a concern in communities where there's a power imbalance in the home. Consider, for example, an overbearing husband coercing his wife to vote in a particular manner, or just taking her ballot and voting it himself (and coercing her to sign the back of the envelope.)

An option considered in one state (Utah?) was to allow mail-in voting, but the mailed ballot could be invalidated if you stopped into a polling place and voted. It adds some complexity but reduces the absolute chance of coercion.

Thanks, I didn't look far enough to see that the bedcover is removable. Now this truck is an option for me.

My definition of truck: if you can't dump a ton of shit in the bed with a backhoe, it's not a truck. It's a minivan.

For me, having a permanent bed cover means it's not useful as a truck.

Windows 10 has two update channels. Under "Windows Update" > "Advanced Options" there are two separate settings to delay "feature updates" and "quality updates".

I don't know whether earlier versions of Windows offer this level of control as I've got Win10 on all my machines. I just leave them on automatic update and yet I still only have two ears.

Great feedback, thank you! Linux targeting isn't my area, but I know the guy who owns it would love to chat with you. If you want to help us make this better, would you mind sending me an email at apardoe @ youknowthecompany.com? I totally understand if it's not worth your time. But thank you regardless!

Sure, I can accept that a platform can be doing more than a website and also that you have less control over a platform. Good points, both.

I won't comment on Android. I already got ripped to shreds above by trying to bring up the point that mobile is completely locked into two major players that act exactly like Windows 10.

Wow, sorry. No, no, I'm not triggered at all. I was only trying to illustrate the fact that there are times when we have no choice but to use an OS that uses telemetry.

I'll happily concede this thread and apologize for having brought it up. I really wasn't trying to start a fight. I was trying to give what I thought was an analogous example.

I didn't mean to offend. I'm just saying that if you think paying for an OS means you won't have data collection, then you're unlikely to find a smartphone that suits you.

My point, exactly, is that Microsoft is just another tech company these days. They're not the Evil Empire. At best, they are one of Many Evil Fiefdoms.

I understand that people are up in arms about data collection. And I understand that Microsoft tends to bungle any kind of public messaging about data collection. I'm just pointing out that every mobile OS, at least, collects tons of data.

And do you write Microsoft with a $? :)

Thanks for the downvotes! But seriously, do you honestly think that Microsoft is spying on your more than Google, Facebook, or Amazon? And do you think your Mac OS doesn't have the exact same sort of telemetry (or more!) that Windows has?

The 90's are over.

So what phone do you carry? A Nokia flip-phone?

I know someone who works at Microsoft (and has for 15 years.) These cartoons are brilliant--especially the org charts for different companies--but things actually are changing at Microsoft.

Some divisions change faster than others. And some old reputations are very hard to shake. But Microsoft isn't the company it used to be. There are other companies filling that role now. Example: Even though all you ever hear about is "Windows is spying on me!" I can name three big tech companies that probably know more about you than Microsoft does.

I've used Linux npm on Ubuntu/WSL without any issues.

You can already target Linux directly from Visual Studio using either WSL or a Linux machine as the target. It uses the compiler on the Linux machine. Details here: https://blogs.msdn.microsoft.com/vcblog/2017/04/11/linux-dev...

And, of course, VS offers Android and iOS targeting in both C++ and .NET. The C++ info is here: https://blogs.msdn.microsoft.com/vcblog/2017/04/18/android-a...

I can either be charitable or accusatory :) It's not so obscure as to how one might run Xcode tools on another Unix-like OS. It's just illegal. Apple tightly controls their entire stack.

I don't think you'll find a way to seamlessly build native iOS apps from Windows. Visual Studio has a great development environment for iOS apps but the compilation still has to happen on a Mac. It's more difficult for developers, but Apple tightly controls their entire stack.

And for all of you on the thread who say Windows is a disaster for developers, I'd love to chat with you. I'm the guy for the MSVC C++ front end and code analysis. Either PM me or mail me: my work address is apardoe at youknowthecompany.com

There's not much preventing any engineer at Microsoft from talking to developers. No lawyers need to be involved :-)

Bruce, thanks for the kick! Six years is a long time to wait for a bug resolution.

It turns out that our compiler has a minimum size limit in a memset optimization. I’m sure the size limit was there for a Very Good Reason (TM) at one point in time, but we are investigating whether we can remove it. Step one is understanding why it was there in the first place.

VS/MSVC has improved a lot. There are details here: https://blogs.msdn.microsoft.com/vcblog/2016/06/07/compiler-... but the long and short of it is that we are working on achieving complete C++98/11/14 compliance by (hopefully) the end of this year. And we have a number of C++ draft standard features implemented already, in both the compiler and the libraries.

Additionally, we're shipping a number of versions of Clang in VS (targeting Windows, targeting Linux/IOT, targeting Android/iOS) and contributing to the community. We're looking seriously into CMake support and contributing back to the community. And the VS Code editor runs on Unix-based OS with IntelliSense, debugging, etc.

So yes, VS has improved a lot, but we still have work to do.

I'd love to chat with you if you have questions. My email is firstname.lastname@microsoft.com. My full name is on the blog that I linked to but I'm really not that hard to find online.

And I've got questions for you if you use Clang and have any interest in Windows. Send me mail and we can maybe set up time for a phone/Skype call.

I'd suggest looking at the papers that were submitted for discussion at the upcoming Lenexa Standardization meeting for references. They're located here: https://isocpp.org/blog/category/standardization

Here's numbers for the ones you listed:

Concepts: http://www.open-std.org/JTC1/SC22/WG21/docs/papers/2015/n436...

Modules: http://www.open-std.org/JTC1/SC22/WG21/docs/papers/2015/n446...

Coroutines: http://www.open-std.org/JTC1/SC22/WG21/docs/papers/2015/n439... & http://www.open-std.org/JTC1/SC22/WG21/docs/papers/2015/n439.... Also http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2014/n413...

operator dot: http://www.open-std.org/JTC1/SC22/WG21/docs/papers/2015/n447...

Uniform call syntax: http://www.open-std.org/JTC1/SC22/WG21/docs/papers/2015/n447...

Here are some others that Stroustrup listed. I think they're probably important proposals. I imagine Stroustrup has at least some priority order in his list.

Ranges: http://www.open-std.org/JTC1/SC22/WG21/docs/papers/2015/n438...

Comparisons: http://www.open-std.org/JTC1/SC22/WG21/docs/papers/2015/n447... & http://www.open-std.org/JTC1/SC22/WG21/docs/papers/2015/n447...

array_view: http://www.open-std.org/JTC1/SC22/WG21/docs/papers/2015/n434...

Pay attention, Scott :)

Sorry. Triton is the Windows Phone 8 "Compiler in the Cloud". It basically split NGen into two pieces, allowing the optimization to happen in the Store while the .exe generation happened on the device. The interface between these two halves is MDIL.

Bing will tell you a ton about Triton.

@BuckRogers, these two are related somehow. We've definitely benefitted from conversations with the M# people and they've likely benefitted from conversations with us. In fact, Joe Duffy once worked for our humble little .NET team :)

Reflection.Emit isn't allowed in the Windows Store profile so we haven't handled it in this go-around. Expression compile is supported and handled properly.

@rajeevk, we could compile from MSIL and not tell the developer. But you probably appreciate the chance to test out the app on your own the way your user will run it. After all, you'll want to profile it or maybe find that last on-device, optimized-only bug...

@Pantaloons: Right on all counts. One clarification: .NET Native and MDIL are orthogonal. MDIL was used in Triton to split NGen into conceptually two pieces: the optimized part (in the Windows Phone Store) and the part bound on the customer's device to the installed Framework.

.NET Native produces completely native binaries. MDIL/Triton produces NGen binaries that still need a runtime and, occasionally, a JIT.

Today, Windows Store. Tomorrow, the world! :)

.NET Native addresses many of the same issues as Mono AOT but it has a radically different basis. We had the advantage of hindsight :)

The biggest difference with NGen is the fact that .NET Native doesn't ever "fall back" to JIT compiled code. There are other differences--refactored runtime, static-optimized libraries, static marshalling, etc.--which can be seen by the perf wins over NGen. We're seeing 40% startup performance gain over NGen apps for top Windows Store apps.

@jimmcslim Quite right, the smaller Windows Store profile is a more scoped target. But everything is on the radar.