News for hackers. Stuff that matters.

A comment on Linux Kernel Use-After-Free Remote Code Execution Vulnerability. Parent comment

Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera... by topspin on Wednesday October 05, 2016 @03:13AM (#12642033)
Well that's the thing about C and its ilk; it is an endless wellspring of awful failures and so the voices you are trying to shout down have an unlimited supply of ammo. This will keep happening and you're going to keep hearing about it and the arguments for alternatives will continue to strengthen. That's the reality to which you need to adapt, if you're a reasonable person.

The advocates of these alternatives aren't creating this situation. The unavoidable fact is that our traditional tools have a propensity to propagate bugs that are fabulously difficult to discover. That's one of the lessons of nearly a half century of C. New tools are emerging that solve this problem and their advocates have every reason to say so.

Another lesson C teaches us through its popularity and longevity is that performance will always be critical for systems code; there will never be a day when we can squander cycles and RAM on garbage collectors and reference counts and indirections and all the other bookkeeping and abstractions inherent to so many languages that have utterly failed to displace C for systems programming.

I don't know what the future looks like. Maybe it's Rust. Maybe Linus will get fed up and invent a better language in 4 days. Maybe someone will create an AI system that can spot this sort of bug before it ever gets checked in. All I know for sure is that the current situation is intolerable and yelling at people to shut up about it won't work.

[ Parent | on HN ]
Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera... by qwertyuiop924 on Wednesday October 05, 2016 @05:27AM (#12642564)
I'm fine with admitting C had flaws. It does need to be replaced for many projects. It's just the smug comments on HN that irritate me, especially because most of us are already in agreement (including me, now), and those who aren't won't be convinced by the sheer power of smugness. In short, I'm not complaining because the people who do this sort of thing are wrong, but because they're not actually helping.
[ Parent | on HN ]
Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera... by pjmlp on Wednesday October 05, 2016 @08:17AM (#12643145)
Hence why I support projects done in Go, even if I dislike the design decisions regarding its type system.

Every program written in Go is one program less written in C.

[ Parent | on HN ]
Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera... by qwertyuiop924 on Wednesday October 05, 2016 @09:50AM (#12643755)
Fair enough.
[ Parent | on HN ]
Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera... by phyzome on Wednesday October 05, 2016 @08:44AM (#12643292)
Hey, you know how to get rid of the smug comments, including this one?

...

Make sure there's less C code around.

[ Parent | on HN ]
Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera... by qwertyuiop924 on Wednesday October 05, 2016 @09:50AM (#12643757)
Unfortunately, when you get rid of C code, comments don't get deleted.
[ Parent | on HN ]
Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera... by MaulingMonkey on Wednesday October 05, 2016 @02:16PM (#12646328)
Now now, some C code is commented.
[ Parent | on HN ]
Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera... by qwertyuiop924 on Wednesday October 05, 2016 @03:06PM (#12646768)
All right, I'll admit it, I laughed out loud when I heard this. Maybe it's because of my all-too-fresh experiences trying to decipher undocumented C as a newbie (which I still am). It almost makes this thread worth it.
[ Parent | on HN ]
Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera... by zigzigzag on Wednesday October 05, 2016 @04:40AM (#12642372)
I don't know about that - very little software is written in C these days. Even parts of the Windows and Mac kernels are written in at least C++ and Microsoft had an entire OS written in C# internally. Meanwhile the games industry has been C++ since forever (which still isn't great but better than C) and most business and web software is written in GCd languages.

BTW the kernel is full of reference counts.

[ Parent | on HN ]
Re:Linux Kernel Use-After-Free Remote Code Execution Vulnera... by johncolanduoni on Wednesday October 05, 2016 @05:18AM (#12642531)
> BTW the kernel is full of reference counts.

I think the OP is pointing to languages like Swift/Objective-C where reference counts are used even if you don't really need them, not that ever reference counting anything is a lazy abstraction.

[ Parent | on HN ]