News for hackers. Stuff that matters.
Re:Serious Chrome zero-day by naikrovek on Wednesday March 06, 2019 @06:49PM (#19324200)
That doesn't mean that they (or anyone) should still be using it.

The choice of language 15 years ago has nothing to do with the languages that could be in use today on the same project.

Rust has `unsafe` all over the place; it's no more safe if you use that keyword to do the same things that are done in C++.

Get more compiler people on Go and it will be even faster than it is now (really fast), and Go is written in Go so there's no reliance on C++, unlike Rust.

Re:Serious Chrome zero-day by pcwalton on Wednesday March 06, 2019 @07:04PM (#19324312)
> Rust has `unsafe` all over the place; it's no more safe if you use that keyword to do the same things that are done in C++.

Yes, it is, because the language has the concept of safe code to begin with. The problem with C++ is that all C++ code could potentially be unsafe.

> Get more compiler people on Go and it will be even faster than it is now (really fast), and Go is written in Go so there's no reliance on C++, unlike Rust.

This is a very confused comment. Rust is also written in Rust. If you're thinking of LLVM, sure, the Rust compiler uses that, but LLVM is nowhere to be found in products written in Rust that are shipped to users. What matters is how safe the runtime is, and there's no real difference between Go and Rust in this regard. Go might theoretically have some kind of edge over Rust in safety in that it calls syscalls directly instead of going through libc, but I highly doubt it matters in practice, because (a) the libc wrappers are a drop in the bucket compared to the complexity of the kernel; (b) Go only does that on Linux these days anyhow.

Re:Serious Chrome zero-day by piano on Sunday March 10, 2019 @09:56AM (#19351995)
Yup, and besides, Go has the unsafe (https://golang.org/pkg/unsafe/) package, which allows for basically the same sort of unsafety as Rust's unsafe.

In fact, I would say Rust is typically more safe than Go, because in Rust you can mark any code as unsafe, it doesn't necessarily have to involve unsafe pointers. For example in Rust FFI functions are typically marked unsafe even if they don't involve pointers. There's no way to do that in Go.

Another example is strings: Rust ensures that strings are always valid UTF-8 by marking any function that could break that as unsafe. OTOH in Go you strings can contain invalid UTF-8 if I recall correctly.

Re:Serious Chrome zero-day by naikrovek on Thursday March 07, 2019 @11:07AM (#19329162)
I thought Rust was written in C++, apologies.
Re:Serious Chrome zero-day by roca on Wednesday March 06, 2019 @08:58PM (#19324950)
My project currently has 104366 lines of Rust code and 174 uses of 'unsafe' (many of which are somewhat spurious, like usage of `mmap` and other system calls that don't have safe wrappers in external crates). My project does a lot of low-level stuff (e.g. ptracing, sharing memory with C++ code in other processes) and has lots of crazy low-level optimizations but still only has one use of 'unsafe' per 600 lines of code. I haven't made any particular effort to reduce usage of 'unsafe' either.

> it's no more safe if you use that keyword to do the same things that are done in C++

Sure, but using 'unsafe' everywhere that you would write unsafe C++ code simply isn't idiomatic Rust and except for very specific and limited situations, Rust developers don't do that.

Re:Serious Chrome zero-day by kllrnohj on Wednesday March 06, 2019 @07:00PM (#19324281)
> Get more compiler people on Go and it will be even faster than it is now (really fast), and Go is written in Go so there's no reliance on C++, unlike Rust.

You'll still be stuck with the fundamental tradeoffs that Go made like being GC'd and not having a fast FFI.

Those tradeoffs make sense in the target audience of Go (servers), but it's not going to make sense in something like a web browser.

Re:Serious Chrome zero-day by naikrovek on Thursday March 07, 2019 @11:09AM (#19329181)
Go has a garbage collector, and it's the fastest garbage collector that currently exists, by a wide margin, I believe.

When Go 1.8 released, it measured < 1ms garbage collection times on an 18GB heap, and that number has improved in the 2 years and 4 releases since then.

I don't believe that "it uses garbage collection" is a valid complaint against Go anymore, except in a real-time application, and I don't know of any real-time applications written in Go. I'm sure there are some, I just don't know of them.

Re:Serious Chrome zero-day by lpil on Sunday March 10, 2019 @05:05AM (#19351092)
Go's garbage collection is optimised for reducing GC pause times, and while it is extremely fast in this regard this is only one of many ways GC performance can be measured.

If for your workload GC pauses are tolerable and throughput is important (say when doing offline CPU bound batch processing) then the Go GC is not optimal for your use case and will be slower than other options on the market.

Some runtimes (such as the JVM) allow the user to pick from one of many GCs so that they can use the one that is most appropriate for their workload.

Re:Serious Chrome zero-day by kllrnohj on Thursday March 07, 2019 @01:33PM (#19330692)
A fast GC doesn't mean the code wouldn't have been faster without a GC.

GC's prevent you from doing a huge range of techniques to improve cache locality or reduce allocation/free churn.

A simple example would be games will do things like have just a big allocation for all a frame's temporary data, and they just bump-pointer allocate from it. Then when the frame is over, they reset back to zero. It is already The Perfect GC. Bump pointer allocation, zero pause time, and perfectly consistent memory usage. No matter how good Go's GC gets it will always be slower than that.

At the other end of things you have things like LLVM's PointerUnion, where alignment requirements are (abused) to cram a type id into the lower bits of the pointer itself. Type-safe variant in the size of a void*.

Re:Serious Chrome zero-day by pjmlp on Friday March 08, 2019 @03:10AM (#19335954)
> GC's prevent you from doing a huge range of techniques to improve cache locality or reduce allocation/free churn.

This is only true in languages which don't provide other means of memory allocation.

D, Modula-3, Mesa/Cedar, Oberon variants, Eiffel, .NET all provide features for such techniques.

Re:Serious Chrome zero-day by apta on Thursday March 07, 2019 @11:40AM (#19329484)
> Go has a garbage collector, and it's the fastest garbage collector that currently exists, by a wide margin, I believe.

Fastest by what measure? I benchmarked some key value store implementation written in golang and ran into large (> 1 sec) latency spikes because the golang gc couldn't keep up with the large (10GB+) heap space. Java would have allowed me to select a GC algorithm that's best for my use case and I wouldn't have run into that issue.

golang's gc is tuned for latency at the expense of throughput, that's basically it. It's not some magic bullet that solved the gc issue, contrary to what the golang marketing team wants people to believe.

Re:Serious Chrome zero-day by pjmlp on Thursday March 07, 2019 @02:55AM (#19326307)
Fuchsia team thinks otherwise, where kernel level stuff like the TCP/IP stack and IO volume handling are written in Go.

Android team also makes use of Go for their OpenGL/Vulkan debugger.

Now, lack of generics is really a big pain point.

Re:Serious Chrome zero-day by kllrnohj on Thursday March 07, 2019 @01:36PM (#19330729)
> Fuchsia team thinks otherwise, where kernel level stuff like the TCP/IP stack and IO volume handling are written in Go. > Android team also makes use of Go for their OpenGL/Vulkan debugger.

Neither of those examples disagree with what I said. Fuschia's usage is the perfect example of agreement - Go specializes in IO (server workloads) and is then being used to do IO. That's a great usage of Go's particular blend of capabilities.

The use of GO in GAPID would be more interesting if it had any meaningful constraints on it, but it doesn't. It's an offline debugger for something that ran on a device with a fraction of the speed.

RenderDoc would be the meatier Vulkan debugger, and it's C++.

Re:Serious Chrome zero-day by pjmlp on Thursday March 07, 2019 @02:27PM (#19331286)
GAPID is an online debugger and a TCP/IP stack needs to be really fast.

As early C++ adopter I always find ironic how people give examples of C++'s code generation performance.

Back in the old days, tying to use C++ would generate exactly the same kind of performance bashing.

Re:Serious Chrome zero-day by IX-103 on Wednesday March 06, 2019 @09:15PM (#19325023)
Sorry. Until Go gets its head out of its ass and gets proper generics Go will still be painful to use and slow. Not to mention with all the extra code complexity from writing everything with interface{}{} and reflection there are bound to be plenty of exploitable vulnerabilities. I honestly think it is worse than pre-generic Java because switching over the type of the variable is encouraged. Most sane type-checked languages kinda expect you to know what type you're working with at compile time.
Re:Serious Chrome zero-day by naikrovek on Thursday March 07, 2019 @10:51PM (#19334930)
Generics are slower, that's the trade-off. Developer time vs. execution time.

Saying Go has it's head up it's ass is extremely disrespectful to the people that created it and are maintaining it. You lost all credibility when you chose the low road and said that.

Re:Serious Chrome zero-day by PopsiclePete on Friday March 08, 2019 @03:59PM (#19342115)
Look, there are core Go developers who admit that parametric polymorphism is a good idea. In fact, I'm not aware of anyone on the Go team arguing against that. Which is what you mean by "generics", right? In fact Go already has "generics" - maps, slices, channels. Are those "slow" in your opinion?

The only thing left to do is to propose a system that has reasonable trade-offs, doesn't suck, and doesn't completely break the existing language. Easy peasy!

I wonder who is doing Go more a disservice - people who hate everything about, or the blind fanatical devotees who think any criticism towards any aspect of Go is heretical.

Re:Serious Chrome zero-day by GenericsMotors on Friday March 08, 2019 @03:11PM (#19341705)
You lost all credibility when you wrote that first sentence.

But you carry on using empty interface with runtime type assertions and reflection if you think that's faster.

Re:Serious Chrome zero-day by naikrovek on Friday March 08, 2019 @10:20PM (#19344229)
Well, pardon me for stating things as I understand them and making a mistake in doing so.

I sincerely apologise for wasting your time by typing something that was true as I understood it.

Clearly you've never made a similar mistake.

Re:Serious Chrome zero-day by GenericsMotors on Saturday March 09, 2019 @08:26AM (#19346002)
It was not true yet you stated it with certainty as fact.

Not interested in your snarky "apology".

Re:Serious Chrome zero-day by ketralnis on Friday March 08, 2019 @03:20PM (#19341790)
Most generics work by monomorphisation, which basically means the compiler is doing a copy paste from int_btree.go to string_btree.go with the types changed. There is no runtime cost except text segment bloat. Generally modern compilers are smart enough to unify the identical machine code paths too, so you might not even get the code bloat.
Re:Serious Chrome zero-day by fredmorcos on Friday March 08, 2019 @02:33PM (#19341331)
> Generics are slower, that's the trade-off. Developer time vs. execution time.

You have no idea what you're talking about.

> Saying Go has it's head up it's ass is extremely disrespectful to the people that created it and are maintaining it. You lost all credibility when you chose the low road and said that.

No it's not disrespectful, it is entirely true. Do consider the origins of Go, where it all started as an experiment in combining bad decisions into a single programming language to see what would happen. What those very people didn't realize upon releasing it to the world is the sheer amount of people who fell for it, it was supposed to be a joke, with a stupid looking mascot and all... Now they have to take it seriously - and Google has to choose between keeping it alive or getting a forever bad rep for killing it - because too many companies rely on it, and they are forced to retrofit useful features on top of the giant pile of garbage they've created.

Re:Serious Chrome zero-day by naikrovek on Friday March 08, 2019 @10:30PM (#19344264)
> No it's not disrespectful, it is entirely true.

Yes, it is disrespectful, and no, it is not entirely true.

If you want to talk literally, a team has no ass to shove things into.

If you want to talk figuratively, making mistakes does not constitute having your "head up your ass." Even making multiple mistakes doesn't warrant that kind of statement. It's rude and it's pointless and doesn't add anything at all except to make you look asinine. So now you're just as asinine as I am with my misunderstandings. Well done.

Re:Serious Chrome zero-day by fredmorcos on Saturday March 09, 2019 @04:19AM (#19345284)
(I'm going to ignore the personal attack and insult)

> If you want to talk figuratively, making mistakes does not constitute having your "head up your ass." Even making multiple mistakes doesn't warrant that kind of statement.

Making deliberate mistakes multiple times and resisting fixing them for 10 years does qualify as having their "head up their ass" (or asses if that's what you prefer).

Re:Serious Chrome zero-day by johntyree on Friday March 08, 2019 @02:48PM (#19341505)
I don't know about the origin story, although frankly I hope it's true.

Personally, I think Go is terrible. However, I can't imagine Google is even remotely considering scrapping Go. It is massively popular. It is used all over the place both externally and internally. It's a huge branding asset, community outreach tool, recruiting tool and provides leverage in the form of first party libraries over the direction that software development as a whole is going.

Re:Serious Chrome zero-day by flavio81 on Sunday March 10, 2019 @01:00AM (#19350604)
>Saying Go has it's head up it's ass is extremely disrespectful to the people that created it and are maintaining it. You lost all credibility when you chose the low road and said that.

No, because Go really has its head up it's ass.

Re:Serious Chrome zero-day by steveklabnik on Wednesday March 06, 2019 @06:56PM (#19324245)
> Rust has unsafe all over the place

This does not match my experience nor numbers I’ve seen. What leads you to say this?

(Also, other than LLVM, Rust is written in Rust. And when cranelift lands, you could remove that too.)

Re:Serious Chrome zero-day by karavelov on Wednesday March 06, 2019 @08:04PM (#19324699)
Apart from memory safety issues, there are type safety issues that can cause equal security harm. Go's approach of casting interface{} back and forth is as dangerous as allowing malloc/free. The worst part is that the language designers don't see this as a problem.
Re:Serious Chrome zero-day by platinumrad on Wednesday March 06, 2019 @08:29PM (#19324825)
interface{} is not great but it is not void *. Type assertions (casts) on interface{} are typechecked at runtime and failed type assertions on interface{} cannot violate memory safety.
Re:Serious Chrome zero-day by pcwalton on Wednesday March 06, 2019 @10:24PM (#19325304)
Interface in Go can actually violate memory safety because of object slicing when racing on a variable concurrently from multiple goroutines (unless things have changed lately). It's two words (data and vtable) and so there is a tiny window in which one goroutine could change the data pointer while another goroutine is reading the two words, and so have a type mismatch that could probably cause arbitrary code execution in theory.

I've never heard of this happening in practice, however.

Re:Serious Chrome zero-day by platinumrad on Wednesday March 06, 2019 @10:56PM (#19325405)
Unless I'm misunderstanding you, you're just talking about a garden variety data race on any interface value in shared memory right? If that's the case, I don't see what it has to do with interface{} in particular (or interfaces at all) as any multiword value in shared memory is susceptible to this, which is the unfortunate price you pay when your language supports shared memory concurrency but doesn't have any allowances for it in its type system.

Of course, data races are usually race conditions too, meaning that even if the memory corruption were prevented, there would probably still be a correctness bug to worry about, so I can understand why the Go authors chose the tradeoffs that they did.

Edit: Reread your comment and I get the part that is specific to interfaces now. This seems harder to exploit than, for example, a read of a slice header being... sliced... resulting in an out of bounds access.

Re:Serious Chrome zero-day by gpderetta on Friday March 08, 2019 @07:50AM (#19337064)
Some languages guarantee memory safety even in the presence of data races (for example Java), while others simply prevent data races in their safe subset (rust). Go is normally memory safe but data races on some critical objects can compromise it.