No language you use can get around syscalls, so i have no clue as to why this is a case against C.

Not all OSes have unsafe syscalls, nor do all OSes have to be implemented in C.

But the most used are and I can't see it change anytime soon.

Hence why it is about time to change the status quo.

As others have noted, one can also write a four line saferead() function.

And once you have written a five line safewrite() function, a hundred-line saferecvfrom() function, a 1500-line safeioctl() function, and all of that, and you have a third-party static analysis tool to prove that you're never calling the unsafe read() or ioctl() functions except from the wrappers, what was the advantage of staying in C in the first place?

I see where you are going, but I don't get how you get from 4 to 5 to 100 to 1500?

I can answer: safe read/write from a simple system call can be "easy." Safe read from the network, possible but no longer easy. Safe call to ioctl, which can literally do anything with any device driver... is a "safe" version of that even possible?

If we're expanding the set of possible bugs to "the kernel can do anything and overwrite anything", then it doesn't matter what language you use.

ioctl is a marshaling mechanism that can represent a library API of almost unlimited proportions and variety. A safety wrapper basically has to target the specific functions, rather than ioctl itself. That has happened within Unix, with some library functions having originated as wrappers around ioctls.

safeioctl may have to contain a redundant switch (or more OOP-style dipatch across multiple functions) on the command code in order to convert the safe style arguments to each specific low level ioctl call. That sort of thing can easily explode in line count. I can see exactly what geofft is talking about.

It's not like your rust safe ioctl wrapper is going to be any less code, though.

Ok - it's true that ioctl has a generic interface (hadn't remembered that). We can think of it as hundreds of functions, not just one. So wrapping ioctl "completely" is correspondingly a lot of work.

However the point was of course to make a safe-land layer which contains the needed functionality. The point was never to have a function "safeioctl" in the first place.

The advantage is that you're depending only on yourself and C. That third party static analysis tool can just be "grep". Or some mild text processing on the output of "nm" to validate that no object files (other than the allowed ones) have external refs to those symbols.

I think it's a massive programming ecosystem blind spot that "depending on c" is seen as less of a burden than depending on rust

How many chip and SoC vendors provide a Rust toolchain? In the case of C, the answer is basically "about as many as provide a toolchain".

In 2016, yes.

All the way through the 80's up to the early 90's, C toolchains only mattered to those that were working on UNIX workstations and servers. On home computers it was just, yet another language, with compilers generating slower code than junior Assembly programmers.

So of course Rust has to catch up a few decades of market use.

sure, use c if that's all you can use, but if rust does target your system it adds no more overhead than c does.

tangentially, ats has had some success in that area since it compiles via c. but I agree that c is less work to get set up with.

Or just disallow platform headers.

Again, if you're disallowing platform headers and writing tooling to make sure you're never calling libc, what's the advantage of writing in C? You have all the headaches of switching to a new language, with none of the features.

And, honestly, one of the features is "vibrant community of developers." Even if Go and Rust were bad languages, which they're not, they'd still be better choices than C-with-custom-in-house-restrictions-and-libc-wrappers, simply because of the communities around them. If you're writing in Rust, someone else has already written the safe C wrappers, and if they haven't, there's a community of people who will code-review your wrappers for safety and merge them into a centrally-maintained project, which is extremely useful.

I'm not advocating use of C, just pointing out a simpler way to check dependencies.

To answer your question though, the advantage of using C is certainly not the notorious bad-habits standard library. C is fun and productive exactly where there's just you and some bits and bytes to bang around. Coding in the small. Not platforms and architectures.

You can easily access external symbols in C without including a header. The external refs in an object file are the accurate info about what is referenced.

Granted. Just as you can easily corrupt memory.

Just as you can statically link libc, without it showing up in the symbol table.