Re:Checked C: Making C Safer by Extension
by pjmlp on Sunday September 09, 2018 @01:30AM
(#17944518)
That is nice for userspace apps, but no one is going to use c2rust on Aix, HP-UX, *BSD, Linux, Zephyr, QNX, RTos, ....
I think something like Checked C is the only way to actually make it work on those use cases.
Re:Checked C: Making C Safer by Extension
by littlestymaar on Sunday September 09, 2018 @07:59AM
(#17945497)
No one is going to use Rust on any of these projects, because of political reasons and portability concerns (because LLVM doesn't target all platforms). But those two issues also apply to Checked C and I doubt any project you listed will ever use it either.
Re:Checked C: Making C Safer by Extension
by sanxiyn on Sunday September 09, 2018 @08:50AM
(#17945668)
Since BSD's system compiler is now LLVM, I think it's only a matter of time some enlightened BSD variant (OpenBSD maybe?) tries something like Checked C.
Re:Checked C: Making C Safer by Extension
by pjmlp on Sunday September 09, 2018 @10:43AM
(#17946084)
I don't know what programming language or extensions they will ever use, but this year's Linux Security Summit was pretty clear that are lots of work to do regarding Kernel Self-Protection Project still need to be done.
And that is just one UNIX variant.
In addition, we also have the bindgen tool in Rust that will auto generate the Rust FFI from C header files. It works really well. At that point you wrap the FFI in more Rust idiomatic interfaces, and expose those as the preferred library for others to use.
I mention this, because it is a path toward allowing for the carrying forward of a C codebase, but using a safe language like Rust for all future work, perhaps going back and rewriting the C if it’s deemed important.
There are many examples of this pattern being applied to projects.
In addition to that, there is a cbindgen tool, that does the inverse of the bindgen tool, which would allow you to write Rust code, and quickly generate C header files for the FFI, allowing for critical areas of C to be replaced with Rust, without converting the entire project.
Putting all of that together might be a reasonable thing for large projects to convert iteratively, should they decide it’s an important thing for them to do.