News for hackers. Stuff that matters.
Re:Select Code_execution from * Using SQLite; (2019) by otabdeveloper4 on Saturday June 13, 2020 @02:20PM (#23511442)
Yeah, I'm sure switching to a more fashionable programming language will automatically fix all bugs and security issues.

(sarcasm)

Re:Select Code_execution from * Using SQLite; (2019) by pdimitar on Saturday June 13, 2020 @02:46PM (#23511655)
Every little bit helps IMO. Rust seems like it eliminates class of bugs (and so do Haskell and OCaml), the JVM looks like it could prevent another subset of them, and I am sure there are other examples.

Not going to bash anyone for using C -- sqlite's team has their priorities and values clearly stated (performance and discipline) -- but it's probably time for all of us to admit that not all recent tech innovation is about fads. Some of it is actually genuinely useful and helps with age-old problems (though sadly, none of it addresses all of them).

Re:Select Code_execution from * Using SQLite; (2019) by anyfoo on Saturday June 13, 2020 @03:28PM (#23511985)
All of them? No. But will a modern language, where many more properties are mathematically proven through the type system, massively improve the situation? Yes.

If you don’t believe me, do the converse and write your next big project completely in assembly (which is effectively untyped), and see what happens.

Re:Select Code_execution from * Using SQLite; (2019) by dathinab on Saturday June 13, 2020 @04:30PM (#23512430)
Through only if has high usability.

You currently can bend C++ into ways to have such a type system. The usability this introduced through additional complexity is just very very bad. So no one does it because bad usability means bad productivity and getting a project done with bugs is often better then getting it not done at all (sure there are exceptions!).

Re:Select Code_execution from * Using SQLite; (2019) by anyfoo on Saturday June 13, 2020 @04:41PM (#23512523)
That's a good point, and I think you've hit one of the main issues why we're still stuck with old, unsafe languages.

There is the saying that once you got a Haskell program to compile, it usually just works, and I personally found it to be true a lot. But getting it through the compiler can indeed be much more of a journey than in, say, C. And I realize that the work you have to put in to just even being able to run something can be discouraging, maybe going against a natural (or maybe just common) affinity towards tight, iterative "change-compile-try" approaches.

Still, in cases where it really matters, i.e. system software or common, but often mission-critical software like sqlite, maybe it's worth taking the jump?

Re:Select Code_execution from * Using SQLite; (2019) by pdimitar on Wednesday June 17, 2020 @07:44PM (#23558181)
I would jump with joy if sqlite3 was rewritten in Haskell, OCaml or Rust. They can bring so much to the table in terms of safety and less development surprises.
Re:Select Code_execution from * Using SQLite; (2019) by saagarjha on Saturday June 13, 2020 @03:33PM (#23512027)
Removed undefined behavior from your code with this one weird trick!
Re:Select Code_execution from * Using SQLite; (2019) by jrockway on Saturday June 13, 2020 @09:19PM (#23514333)
I am not really talking about the present day, though I agree with the other comments that a lot of modern features help. Think back to the era of Lisp machines. Memory safety, macros, OO... all in the 80s!

We ignored the lessons and paid the price. People, to this day, still look at you weird when you say "I think you could write a game in a garbage collected language" and don't bat an eye when you say "C is dangerous, but I was very careful."

I think what killed us is that computers are expensive (and performance directly translates to the number of computers you need to buy) and security holes are free. Of course you're going to optimize for speed; optimizing for safety can save you at most zero dollars. That's just engineering.