throwaway894345
throwaway894345 on Hacker News
Even if you believe this is true and the experts are wrong, other languages don’t require even these “basic levels” to provide a greater degree of safety, so presumably they’re still the better choice if only for this reason (not to mention all the others).
> In practice, memory safety is also not even remotely the main issue to worry about, especially when writing a compiler.
I agree—but those other concerns (e.g., attracting developers) are overwhelmingly reasons not to use C.
> It is not easy to write correct code in any language
Right, but “impossible” and “not easy” are different, right?
> See the number of CVEs in the Rust rewrite of coreutils
How are we supposed to derive anything from this? The 44 Rust rewrite CVEs were the result of a comprehensive professional audit that Canonical paid for and which the coreutils project has never experienced. Moreover the coreutils project predates CVE trackers. If your point is “Rust doesn’t preclude logic errors”, then who are you arguing with?
> including still memory safety issues
Which of the 45 or so CVEs were memory safety?
Given the choice between a language that requires expert coding for minimal safety guarantees and one which can tolerate human error, I’ll take the latter all else equal. Also, given that experts feel they can’t write correct C reliably, I’m inclined not to think I can (never mind contributors).
> At the same time, the Rust rewrite of coreutils with more than 100 CVEs does not exactly convince me that the problem is mainly the choice of language.
I’m not a Rust fanboy, but I don’t know what I should make of this. Is 100 CVEs a lot for coreutils? If the idea is “Rust doesn’t preclude all CVEs therefore language choice doesn’t matter”, I don’t think that follows.
> Still, I think there also many obvious benefits from using C.
The only I can think of are that the toolchain—but not the compiled programs—-can run on niche hardware (minor benefit), that bootstrapping may be easier, and that the toolchain may be more performant (although Go compiles faster than most C-based toolchains I’ve seen, so I’m inclined to think the language matters less here than the compiler design itself).
It’s not obvious to me that the secure approach is measurably more work than the insecure approach. Someone had to go out of their way to add support for remote temperature control.
> Of course there are ways to setup these things securely, same with smart tvs and doorbell cameras and whatever else is getting hacked.
No one expects a $20 IoT light switch to ship with its own network equipment, but a $600,000 to $1.5M fleet of freezers for a single grocery store can ship with its own network equipment without increasing the cost a single percentage point.
> You yourself are engaging in cost prioritizing without adequate information
I had hoped that was obvious from the question mark in my original post :) I’m asking what information reconciles this “it feels like they went out of their way to make this insecure” security posture. Responding with “they must have information you don’t have or else they wouldn’t have done it that way” is neither helpful nor logical.
Trump received a 12 hour temporary ban for that video, because he lied that the election was stolen from him and he praised the rioters.
Trump was banned for more Tweets that Twitter judged “likely to incite more violence” like January 6th, particularly because plans for more violent attacks had begun proliferating, including more attacks on the US Capitol and state capitols on January 17.
> he was never convicted of anything
Private platforms don’t require a criminal conviction, and anyway his SCOTUS appointees invented a brand new Presidential Immunity doctrine expressly to protect him.
> so your accusation has no legal basis
“Not convicted” != “no legal basis”
> As far as facts go, here's what's established: Trump was deplatformed for political speech for 2 years
Nope, Trump was deplatformed for inciting political violence.
> Leftist cheer on the politically-motivated censorship of the other side, and then when Dem account is banned 1 hour and everyone is crying their eyes out
You would have a point if you can point to a case of leftists complaining that their candidate was deplatformed for trying to overthrow the government, but obviously that hasn’t happened so you have to pretend that attempting to overthrow the government is comparable to run-of-the-mill campaigning.
I also don’t know that I would throw stones about “crying” if my side has an annual meltdown about the decorations on Starbucks cups :)
And even though I like writing C, the build tooling and the lack of modules system and a bunch of other footguns remain. (And say what you will about language-specific build tools, but they work very well for 99% of cases, and the benefits of the entire ecosystem using the same tool are significant).
Moreover, I want contributors to my language, and the reality is that however much I like C, the intersection of people who want to work on my language and people who like writing C is going to be vanishingly small. If my language is C-like (e.g., Zig) then that intersection will likely be much bigger, but as the target language approaches C, the benefit of using C goes to 0.
None of this requires the customer to be technical, the ORM could ship the equipment with the network setup, and installation would just be connecting the DMZ device to the Internet.
I’m sure there are benefits to a C toolchain, but the costs overwhelmingly favor self-hosting for many languages.
Bootstrapping is a one-time cost, but implementing the toolchain in C is a cost everyone has to pay every single time they touch the toolchain source.
EDIT: I’m mistaken, this is a US senate candidate. I was confused by the ambiguous wording in the article.
> In 2021 we saw a coordinated deplatforming of a sitting president across practically every social media platform.
It wasn’t coordinated, it was a bunch of social media companies responding to the same event, notably the president in question using his social media accounts to try to overthrow the US government.
EDIT: I’m mistaken, this is a US senate candidate. I was confused by the ambiguous wording in the article.
It's fabricated until you provide a credible source. Even if you provide a source, my criticism of your statistic would still not be "ad hominem".
> The ad hominem was in accusing me of someone trying to dig themselves out a hole
That was never my argument, you pivoted the conversation to my motives, and I told you that I enjoyed watching people try to dig themselves out of holes.
> because you can't accept being wrong. It's the only reason you're still replying.
More ad hominem. It seems to be all you have. :)
I don't know what observation you're talking about--you were giving an analogy, right? What am I misunderstanding about your claim?
> It is just like when say, biology have to reach out to chemistry and chemistry to physics and physics to math for deeper explanations for processes and observations that are native to their domain.
Yes, this is emergent complexity and physicists already look into this (e.g., holographic principle). In your game/engine analogy, we're still talking about examining the game, not the game engine.
Yes, physics is about learning about the rules that the game engine implements. It’s not about learning about some reality outside our own, that’s the domain of metaphysics. Physics can’t answer questions about what is happening outside our own reality, and indeed neither can anything else inside reality because (as you pointed out) we can only test and observe what the game engine allows.
You’re mistaken, and pretty obviously so tbh
> Again, when 99.9% of usernames with the form throwaway+random number string are throwaway accounts
Your entire argument is predicated on this completely fabricated statistic.
> You put the emoticon to indicate a perhaps tongue in cheek response, bur the rest of the text and conversation didn't really support that, nor do the continuing replies.
I’m the authority on my own emotional state, but also as a native English speaker I can assure you that our dialogue thus far comports perfectly with someone who was speaking tongue in cheek, but who also doesn’t mind watching people try to dig themselves out of holes they created for no discernible benefit :shrug: