To what end, though? So the mostly dead people responsible can rest more easily in an uncaring universe?

We may as well remember Lucy, the former vacuum tube assembler and current resident of the dustbin of history.

So that people learn from the past and prepare for a better future.

For example, many millennial have this strange idea that C and C++ are the only option for native AOT compiled code, with language features for cache control, RAII or system programming in general.

The aren't the only option, they became the only option given the decisions that the OS vendors took regarding which languages to sell to their customers on the OS SDKs.

Many of those decisions weren't taken in terms of language quality, rather due to money as UNIX was a free OS, whereas other OSes with better Rust like safety were of course more expensive than free.

So young developers get taught this myth that C was the first system programming language, when in the mid-60's we already had mainframe systems being programmed in type safe systems programming languages, across the whole stack.

Using languages like NEWP (https://en.wikipedia.org/wiki/NEWP), just to give one example. A language where one already had the distinction between safe and unsafe modules, with unsafe modules requiring administrator privileges to run.

Most of the wiki article is speculation on the origin of the name.

With a link to the NEWP manual and other others ones that you didn't follow.

But if you prefer more in-depth information:

https://en.wikipedia.org/wiki/Burroughs_large_systems

http://www.cs.virginia.edu/brochure/images/manuals/b5000/bro...

http://www.smecc.org/The%20Architecture%20%20of%20the%20Burr...

https://news.ycombinator.com/item?id=6988535

https://www.youtube.com/watch?v=K3q5n1mR9iM

Did any of those provide safety by means of compile-time checks (as opposed to sophisticated runtime systems, which are by necessity more expensive), though? AFAICT, Lisp didn't, Smalltalk didn't and Oberon didn't.

Not all the use cases that Rust covers, but many of the typical errors that are possible in C, yes.

For example, the NEWP in MCP only allowed unsafe code in modes where the system administrator would configure them as such, back in 1961.

https://en.wikipedia.org/wiki/Burroughs_MCP

https://en.wikipedia.org/wiki/NEWP

If you need unsafe code to implement the garbage collector and other core system facilities, then “selectively” disabling safety doesn't really mean much, does it?

Also, determining whether code is safe to run requires proof, not trust. Since when are system administrators particularly skilled at coming up with proofs?

Who said anything about NEWP using a GC?!

Also the type of enabling/disabling unsafe code in those lanugages was not much different than running "rustc -D unsafe-code"

Also computer admins in the 60's were programmers.

Somehow I'm doubtful that, using 60's-era technology, many non-trivial data structures and algorithms could be proven safe in a mechanized way. As for trusting a programmer's word, it's probably better than trusting a non-programmer's, but enabling unsafe code is still fundamentally a social hack. While you can work around technical problems by social means, this will never constitute a ultimately satisfactory solution.

I am not saying they were full proof, I am saying that systems programming languages from 60's and 70's were much safer than C.

Many of memory corruption issues with C aren't a problem with the stronger type system of Algol and PL/* family of languages.

However OSes written in those languages were commercial, whereas C was bundled with UNIX, distributed for free, because AT&T was forbidden to charge for it.

If it wasn't for that, most likely Rust wouldn't be needed, at least not in the way it looks like.

> Many of memory corruption issues with C aren't a problem with the stronger type system of Algol and PL/* family of languages.

This is probably just my lack of imagination, but, how would you get the same degree of control C offers over the memory layout of data structures (among other things), without giving up on safety, and using only 60's and 70's technology? Even (safe) Rust doesn't help in some cases, say, if you want a single dynamically allocated memory block containing an array of “m” integers followed by an array of “n” floating-points, where “m” and “n” are determined at runtime. Or are you just going to say this is never desirable?

> If it wasn't for that, most likely Rust wouldn't be needed, at least not in the way it looks like.

Because we would still be using tagged architectures, and every machine instruction would incur in the cost of checking these tags? Or because non-determinism is never too big a price to pay for safe memory management? (Never mind the fact that programs also need to manipulate other resources that aren't as plentiful as memory, and thus require eager reclamation.) No, thanks.

Some of the languages that come to mind without GC, Algol and its variants, NEWP, Mesa, Modula-2, Ada.

With GC, Lisp, Smalltalk, Modula-2+, Modula-3, Eiffel, Oberon, Oberon-2, Active Oberon, Component Pascal,....

Keeping the focus on the ones without GC, all of them were use to build full stack mainframes, so of course they supported dynamic structures. Just the memory was measured in KB not GB.

And, yes they did not prevent the programmer of doing a double free or calling free in memory that wasn't yet allocated.

But they prevented:

- implicit conversions between pointers and arrays

- using bad pointers for output parameters in function calls

- bad, implicit, conversions between numeric types

- implicit conversions between enumerated values and integers

- using non-existent enumerated values

- strings with missing terminator

- Using assignment operator when a comparison was intended

- Doing pointer manipulation all over the place instead of when it is really needed

For your m * n example, that is something you can easily do in Ada, even if a bit verbose.

Hence why Rust would be less needed, because we would be in a computing world, where the majority of the exploits C has brought into mainstream computing would be reduced to a very tiny subset, also with unsafe red signs that one has to explicitly opt-in.

And just like with Assembly we could probably manage it, if served in very tiny doses as infrastructure code for other languages.

As for tagged architectures, why not?

Specially since that is what Intel and other manufactures are now trying to push as a workaround tame C corruption errors.

But all of that is history now, and we really do need languages like Rust to make the lower layers of our OSes and language runtimes safe.

> And, yes they did not prevent the programmer of doing a double free or calling free in memory that wasn't yet allocated.

Well, in 2016, or even in 1995, dynamic resource (not just memory!) allocation is the norm, not the exception, so, effectively, “unsafe dynamic resource management” means “unsafe” without further qualification.

> (long list)

These are indeed problems with C. Let's not beat a dead horse.

> For your m * n example, that is something you can easily do in Ada, even if a bit verbose.

Rather than “m * n”, it's more like “m + n”, or even “mx + ny”, or even “mx + padding + ny”, but okay.

> Hence why Rust would be less needed, because we would be in a computing world, where the majority of the exploits C has brought into mainstream computing would be reduced to a very tiny subset, also with unsafe red signs that one has to explicitly opt-in.

I would accept this claim if unsafe code would only be used to implement the occasional non-critical system component. But, can you implement a safe language runtime without “opt-in” unsafe language features? Clearly, static checks at some level are the only way of you really want safety. If you don't, that's okay - just be honest about it.

> As for tagged architectures, why not?

Because it's expensive! The user shouldn't have to use his machine to compute something that any responsible programmer would've known in advance. And runtime is too late to fix any mistakes anyway.

> Specially since that is what Intel and other manufactures are now trying to push as a workaround tame C corruption errors.

Well, that's sad.

> But, can you implement a safe language runtime without “opt-in” unsafe language features? Clearly, static checks at some level are the only way of you really want safety. If you don't, that's okay - just be honest about it.

No, because at systems programming level, specially when interfacing with hardware is not possible to have 100% safety.

Not even SPARK or formal methods allow for that, there is always a very tiny portion of unsafety at some level.

But the point is not to remove it completely, rather to contain it to the point that is a tractable problem and easy to review, even manually.

Which is easier to achieve when languages are strong typed and require explicit escape hatches for doing unsafe things.

> Because it's expensive! The user shouldn't have to use his machine to compute something that any responsible programmer would've known in advance. And runtime is too late to fix any mistakes anyway.

Expensive is relative. I rather have the computer do stuff for me, and focus being productive.

Also just like everything else in computing, if there would be more research in that area, most likely the performance would increase.

Given that the manufacturers are turning to tagged architectures ideas to try to sort out the C mess, apparently they see a path forward there.

> > Specially since that is what Intel and other manufactures are now trying to push as a workaround tame C corruption errors.

> Well, that's sad.

Intel has added the MPX extensions to their processors, already available in gcc, clang and msvc++

https://software.intel.com/en-us/articles/introduction-to-in...

There is the new CHERI processor being developed at Cambridge exactly with the purpose of a tagged processor for C code

http://www.cl.cam.ac.uk/research/security/ctsrd/cheri/

> Which is easier to achieve when languages are strong typed and require explicit escape hatches for doing unsafe things.

No disagreement here. What I'm saying is that, in today's environment, requiring escape hatches for dynamic resource management is effectively requiring escape hatches for everything. The worst part is that, in most languages, you don't even need to enable escape hatches to preform nonsensical operations like mutating the same object in two threads, without explicit concurrency control. Literally everything is unsafe!

To the best of my knowledge, the only practical language today that attempts to mitigate these issues is Rust. Even if we somehow revived those old "safer than C even if this doesn't mean much" languages, they would probably not help much.

> Expensive is relative. I rather have the computer do stuff for me, and focus being productive.

With runtime checks, your computer isn't really doing anything for you. Your user's computer is alleviating a problem created by you.

If the user is happy having their problem solved in 500 ms, doing it in 10 ms isn't going to change the outcome.

Besides we have to make those CPU quadcores with 8 threads and a 4 GPU cores busy with something.

Also, as much as I like Rust, they still need to sort out some usability issues like non-lexical ownership.

> Also, as much as I like Rust, they still need to sort out some usability issues like non-lexical ownership.

I'd rather take the inconvenience of declaring the occasional use-once temporary variable, which takes at most 10 seconds of my time, than the inconvenience of tracking object lifetime bugs, which can take days or weeks to fix. Correctness is non-negotiable.

It might be desirable now, but those '60s/'70s OSes probably weren't dynamically allocating memory ever. They'd make a buffer in [their equivalent to] the .BSS section that was M×sizeof(int), and another that was N×sizeof(float), and then they'd process records through those buffers blockwise.

Exactly. In the '60s and '70s malloc was a luxury that most programs didn't have, and so Rust's facilities weren't needed to ensure safety. That doesn't describe the state of play in 2016. Those safer languages from the '60s and '70s would also be inadequate to ensure safety today.

> It might be desirable now, but those '60s/'70s OSes probably weren't dynamically allocating memory ever.

Those systems suddenly seem a lot less impressive now. While the lack of dynamic resource management poses other problems (e.g. determining up-front if the system has enough resources to complete the given task), I can't imagine this being more challenging than implementing a modern runtime system (JIT compiler, garbage collector, green thread scheduler, etc.).

Stack, bounds, and code vs data checks like Burrough's can be encoded with almost no gates in a processor. They can run in parallel to main CPU's activity with CPU results only written if checks succeed. One aspect of SAFE architecture at crash-safe.org did that along with some others. So, no, it's pretty easy and not done since modern processors are optimized to run unsafe, C code. ;)

http://www.smecc.org/The%20Architecture%20%20of%20the%20Burr...

So, in other words, a tagged architecture, except the possible values of the tags are "usable" and "not usable"? Sounds horrible - it's the hardware equivalent of checking at runtime whether a variable is in scope in, say, Python or JavaScript. I don't see any point to checking at runtime what can be known statically.

The tags are more commonly a few types like scaler, array, pointer w/ bounds, and so on. It checks basic stuff rather than full heap safety. Too tired to remember if there's one on that. The point was that runtime checking of critical aspects of safety isn't necessarily some high-overhead operation. The basics that go the furthest cost little to nothing in many designs.

Then, you can go from there in your language or compiler design.

> The point was that runtime checking of critical aspects of safety isn't necessarily some high-overhead operation.

The runtime check doesn't make the operation any less unsafe - it only makes the consequences of an error less disastrous.

"The runtime check doesn't make the operation any less unsafe - it only makes the consequences of an error less disastrous."

I think we have a different definition of unsafe. If you think it's potential to cause problems, then I agree it doesn't make it less unsafe. Alternatively, it does make it less unsafe if that means it reduces the ability to invisibly corrupt data, hack your system, or crash your system. That's what I'm claiming. Even Rust or Ada might have a hard time meeting that definition once their pristine codes are converted into assembly.

> I think we have a different definition of unsafe.

“Potentially without useful meaning”, e.g., indexing an array without knowing whether the the index is within bounds.

> Alternatively, it does make it less unsafe if that means it reduces the ability to invisibly corrupt data, hack your system, or crash your system.

Your kid (your data) attends the same school as a bully (your program). One day, the bully threatens to punch your kid in the face (raises an exception). “But it's less wrong because he never punched your kid! He only threatened it!”

> Even Rust or Ada might have a hard time meeting that definition once their pristine codes are converted into assembly.

As long as the assembly code has the same meaning as the safe program from which it was generated, it's safe.

"Your kid (your data) attends the same school as a bully (your program). One day, the bully threatens to punch your kid in the face (raises an exception). “But it's less wrong because he never punched your kid! He only threatened it!”"

You're going out on a limb here. I'm not even countering that example as it's rigged to prevent that. Instead, I'll point out these unsafe things don't happen in a vacuum: there's something in the language that sets the risk in motion and then there's something else that determines what happens. The compile-time safety stops it from being set in motion. The run-time safety makes things set in motion meaningless as they'll just be exceptions or alerts for admins.

Back to your analogy, it would be more like a prison learning environment where people learned in cells with bulletproof glass while one shouted he was "gonna cut someone" for not sharing answers. He can try every unsafe thing he wants but the glass makes it meaningless. The prisoner that's being targeted can literally just pretend all that unsafety doesn't even exist with no effect.

Ideally, we have prevention and detection. Reason for prevention is obvious. Reason for detection, even in a perfect language scheme, is because compiler or hardware errors (esp SEU's) will make something act badly eventually with runtime measures being last-ditch effort. If there going to be there, though, then might as well lean on them some more if there's no performance hit, eh? ;)

If my analogy is is flawed (which it almost certainly is), yours is even more so: the computing equivalent of your analogy is preventing runtime errors by simply not allowing software components to interact - yes, of course, without interaction there are no errors because there is no computation!

I was thinking about that as I submitted it but was multitasking. You called it so I gotta correct it. So, let's drop the analogy and go back to what I originally claimed: CPU's modified to protect pointers, arrays, stacks, and so on. The primitives forced to be used in acceptable ways. The programmer does the rest expressing the problem in the type-safe HLL.

Now, almost every hack on a system that I can think of requires forcing a pointer to go out-of-bounds or something like that. Further, the rest send in data that becomes code. One check, from Burroughs, is CPU looking for code tag bit before executing which only can be set by OS or isolated service on microkernel. So, that wouldn't work.

What remains, with little performance hit & no static checking, is a system where hackers (a) have to con the admin into installing malware, (b) break the minimal, trusted loader/installer w/out abusing above components, or (c) get a denial of service attack. Forget analogies: the reality is much more impressive given there's almost no high-severity CVE's left. You can also do great static checks and such as I always recommend. Yet, you either don't or rarely need them in practice if goal is integrity or confidentiality rather than availability.

"Check and incidentally... mate" (Sherlock Holmes, Game of Shadows)

> Yet, you either don't or rarely need them in practice if goal is integrity or confidentiality rather than availability.

My goal is correctness. A program that fails with a runtime exception is just as wrong as another that silently corrupts your data. Dijkstra put it very nicely:

“We could, for instance, begin with cleaning up our language by no longer calling a bug a bug but by calling it an error. (...) The nice thing of this simple change of vocabulary is that it has such a profound effect: while, before, a program with only one bug used to be "almost correct", afterwards a program with an error is just "wrong" (because in error).”

https://www.cs.utexas.edu/users/EWD/transcriptions/EWD10xx/E...

Cute quote by Dijkstra that shows he hadn't quite figured out reality yet. So, correctness is your goal. That means you'll have to specify the behavior, safety/security policy, and prove the two equivalent. The implementation, both source and binary, will have to be shown equivalent along with proven free of language-level issues. Finally, you have to do that on triple, modular hardware [1] that's rad-hard w/ similar rigor in its lifecycle. Or use run-time checks [2] for each algorithm that can correct errors probably also on TMR or rad-hard board. Let's not forget the custom circuitry for RAM that works [3].

Darn, Dijkstra or not, you still need some kind of runtime checks and protection for correctness. :)

[1] http://www.rockwellcollins.com/~/media/Files/Unsecure/Produc...

[2] https://galois.com/project/copilot/

[3] https://research.google.com/pubs/pub35162.html

Interesting read. Why wasn't the Burroughs more successful?

I guess money, if you look at the history of computers the majority of interesting stuff failed because it didn't managed to pay for the investments that were done.

C and UNIX got widely adopted, because AT&T wasn't allowed to sell it, so they gave the source code for free to universities. Which then used the code to replace the expensive OSes that they were running on their mainframes.

When AT&T was allowed to charge for it afterwards, they tried to make people pay for it, but failed to do so.

Also around this time UNIX vendors started selling the developer tools separately instead of having them for free. This motivated many to contribute to GNU, which was largely ignored up to that point.

Sending you this link as you might have missed what actually happened on Burroughs end. I thought they petered out and got bought by Unisys. I didn't realize they were Unisys plus were selling billions in MCP systems.

https://news.ycombinator.com/item?id=11621318

So, it wasn't the money for once.

Thanks, I discovered that recently when reading about NEWP.

Have their programmers manual on my reading list.

But got the idea it is a very niche market, even smaller than IBM mainframes.

That's probably true. Most material on the mainframe market says IBM has around 90% of it. Their revenues tend to suggest that, too. Probably the common effect with the First Mover advantage. I'm sure IBM bribing government officials in exchange for contracts helped, too. Let's not forget that angle. The NSA business alone would've been enough to found several, computer companies. ;)

It is successful if you give it a different name: Unisys.

https://en.wikipedia.org/wiki/Unisys

"In September 1986 Unisys was formed through the merger of the mainframe corporations Sperry and Burroughs, with Burroughs buying Sperry for $4.8 billion. "

"The merger was the largest in the computer industry at the time and made Unisys the second largest computer company with annual revenue of $10.5 billion"

As to why IBM dominated, I have a hypothesis that's consistent with what happened to other companies. It's basically Gabriel's Worse is Better effect where certain characteristics improve marketing & uptake. The IBM mainframe, IIRC, were backward compatible or integrated with stuff IBM people already bought. They were optimized for Fortran etc that existing apps were written in where Burroughs was optimized for Algol, the language of the future. Further, in a trend that still exists, people focused on raw performance per dollar instead of reliability, maintenance, security, technical debt reduction, and so on that Burroughs architecture could provide. Similar effect with Intel i432, i960, and later Itanium w/ its excellent reliability/security improvements. Burroughs started taking out hardware security & recently got ported to Intel CPU's IIRC. Intel just stopped taking chances. Both in legacy mode since it's all people buy.

Sad story of how computer market works. The Burroughs systems are still around, though, with Unisys making plenty of money. MCP is on release 17 with Unisys also releasing a tool that lets you run MCP in a virtual machine on a PC. It's called MCPExpress I believe. Here's the page.

http://www.unisys.com/offerings/high-end-servers/clearpath-f...

Some did (SPARK for example), but they sacrificed dynamic allocation (i.e. malloc). Rust's real innovation (in an industry sense) is safe dynamic allocation without GC.

And I wish it manages to succeed, if it wasn't for Rust, the C++ Core Guidelines wouldn't be a thing.

> if it wasn't for Rust, the C++ Core Guidelines wouldn't be a thing

So in a way, Rust has already succeeded.

So, basically, the only thing that is ever dynamically allocated in SPARK is activation records? Sounds overly restrictive.

ATS has had this (via linear types like Rust) for a while, but it's a massive pain to use. Rust's main innovation is gluing together existing ideas with a powerful community backing.