Re:An intro to Zig's integer casting for C programmers
by pjmlp on Tuesday May 11, 2021 @10:04AM
(#27118240)
Ariane 5 error was caused by the remaining 30% programming errors when we leave out the 70% of software failures caused by C typical errors.
So yes, it is quite worthy to reduce the amount of money spent in verification, testing, tooling and culture.
The alternative is to just give up that programmers will never learn and just force verification at hardware level, like Google is doing on Android.
"Memory Tagging for the Kernel: Tag-Based KASAN"
https://www.youtube.com/watch?v=f-Rm7JFsJGI
Oracle on Solaris SPARC,
https://docs.oracle.com/cd/E37838_01/html/E61059/gqajs.html
Apple on iOS,
https://developer.apple.com/documentation/security/preparing...
Microsoft on Azure Sphere,
https://www.microsoft.com/security/blog/2020/11/17/meet-the-...
Re:An intro to Zig's integer casting for C programmers
by messe on Tuesday May 11, 2021 @10:31AM
(#27118534)
Ironically enough, I recall reading that if the overflow hadn't triggered a hardware exception and instead was silently ignored, the first stage would have survived; the code in question had just been carried over from Ariane 4 and was no longer important for the operation of the booster..
Re:An intro to Zig's integer casting for C programmers
by vlovich123 on Tuesday May 11, 2021 @10:41AM
(#27118652)
That’s not an alternative to memory safety. That’s just a basic security measure even if you write everything in a safe language like Rust or Zig (let alone the fact that you have enormous C/C++ legacy codebases that are likely still seeing ongoing development due to switching costs). The reason is you will always have some amount of unsafe code when dealing with the hardware and this is a hardening measure to protect against slipups.
Re:An intro to Zig's integer casting for C programmers
by kjs3 on Tuesday May 11, 2021 @06:23PM
(#27124352)
No. The Ariane 5 disaster was caused by a development team deliberately turning off safety checks. Ada is in all regards a 'safer' language than Pascal, as long as you don't disable the safety features.
http://www-users.math.umn.edu/~arnold/disasters/ariane5rep.h...
http://www.adapower.com/index.php?Command=Class&ClassID=FAQ&...
The Ariane 5 maiden flight disaster illustrated quite clearly that the choice of language has little influence on the actual correctness of a program.
Ada on its own is no better than Pascal in that regard. A formally verified and thoroughly tested MISRA C program can be safer and more correct than a sloppily written Ada program.
So the question is indeed not as rhetorical as one might think - why spend the extra money indeed? Isn't it better spent on verification, testing, tooling and culture, which benefits the development regardless of programming language?