News for hackers. Stuff that matters.
Re:Is OpenSMTPD worthy of OpenBSD inclusion? by jerf on Monday October 05, 2015 @04:02PM (#10334459)
I don't consider my revulsion Pavlovian. Even if I have had that particular connection repeatedly made, the point is that if it requires super-mega-experts to code in a totally specialized manner, using libraries other than the easiest to use, using levels of care attainable only by the top 1% of programmers, it's not a suitable language for the vast bulk of people to pick up. And even the top 1% of programmers would probably be well suited to do something else with their cognitive firepower. The fact that somebody once proved capable of walking on a tightrope between World Trade towers does not prove tightrope walking above vast chasms to be a safe mode of transport.

For crypto, at this point, C is now too abstracted from the hardware to be useful. You need assembler, and that's getting dangerously abstract too, since it's actually an abstract language over the microcode that actually execute, the entire point of which is generally to provide lovely, wonderful things... that trash timing guarantees that crypto would like.

"I had to write code that allows remote attackers to own the machine because it was the only way to avoid impedence mismatch."

Incidentally, since it hasn't come up, note that I consider "C + useful static analysis tools" to be a different language. "C + useful static analysis tools" can be a sensible choice. I still at least have questions about the cognitive load being loaded on to the developer vs. a language that removes the problems entirely, but it must be acknowledged as having radically different cost/benefit profiles. However, I observe that very few people seem to be using useful static analysis tools beyond -Wall.

There are no comments on this comment yet.