dangoodin,
@dangoodin@infosec.exchange avatar

Interesting debate taking place on the oss-sec mail list.

One side: How long until people stop using C and C++ to write media codecs? They should use Rust.

Other side: How long will it take for rust to quit changing the language,
standardize itself, and enforce some notion of API/ABI stability?

https://seclists.org/oss-sec/2023/q3/251

I hadn't heard these criticisms of Rust before. Do programmers and security folk want to weigh in on the strengths/weaknesses of each argument?

fugueish,
@fugueish@infosec.exchange avatar

@dangoodin This is part of a broader pattern of people trying to find a rationalization to avoid change. (Note e.g. the sarcastic quotes around "package manager" — a thing that C/C++ are vastly worse for the lack of, btw.)

Change is scary, people spent decades learning C++, and they are afraid to have to go to all that effort again. I understand that fear, but I have much greater fear of not meeting my ethical duty to build safe products.

C++ also changes fast, and not enough, and in directions that aren't right for everyone. (The progression from C++11 to C++23 is fast and vast — and even harder to use, and new points of unsafety have been baked in!)

danielleigh,
@danielleigh@mastodon.social avatar

@fugueish @dangoodin The C++ community is at least working on the package manager problem, though of course being C++ efforts are split between two big efforts that the standards committee ignores.

Honestly, it seems like the standards committee/process is the greatest weakness of the language. Any substantial improvement never makes it out of endless bikeshedding in committee, and the way the standard is managed forces ignoring large parts of the ecosystem.

bluGill,
@bluGill@kbin.social avatar

@danielleigh

@dangoodin @fugueish Build systems and Package managers should not be part of a language! They make simple problems easy, but they make hard problems even worse. I have a complex project that we have spend over 1 billion dollars to write in C++ (over 15 years). Either you integrate with that mess including our build system (at least it is cmake), and package manager (a home brewed mess the less said about the better) or you don't apply. I can accept using C ABI for integration, but we still need to build your code, and shelling out to cargo is not a good answer. Likewise we already have a package manager that - bad as it is - works and won't be replaced with your half baked system that doesn't even pretend to do everything we need.

If you want to make a build system, make one. If you want to make a package manger make one. If you want to make a language, make one. However don't combine them into one, it just makes life difficult for someone else.

fugueish,
@fugueish@infosec.exchange avatar

@bluGill Just about very other major language ecosystem is moving to integrate all 3 of those things, and there are very good reasons for that.

But, if you can't change your build system but do want to use Rust, you can invoke rustc directly. Chromium does that, for example.

bluGill,
@bluGill@kbin.social avatar

@fugueish

@dangoodin @danielleigh It is a deceptive siren song. It make the easy things easier. However it makes the hard things even worse, and all the special cases that build systems and package systems need to handle are more complex than most people give them credit for.

inliniac,
@inliniac@mastodon.social avatar

@dangoodin Rust has been pretty good for @suricata We do fix up smaller issues after new compiler releases, but there are generally real improvements.

Our biggest issues have been with the crate ecosystem. Too many of them quickly jump on new language features so it's easy to indirectly bump the minimum supported rust (compiler) version unintentionally. But generally we've been able to sort that out with the crate authors.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • uselessserver093
  • Food
  • aaaaaaacccccccce
  • test
  • CafeMeta
  • testmag
  • MUD
  • RhythmGameZone
  • RSS
  • dabs
  • KamenRider
  • Testmaggi
  • KbinCafe
  • Ask_kbincafe
  • TheResearchGuardian
  • Socialism
  • oklahoma
  • SuperSentai
  • feritale
  • All magazines