Hacker News Reader

Comment by flipgimble | Hacker News Reader

When people criticize C as a language they are usually referring to the fact that it easily and frequently allows for many classes of bugs that riddle C code. For decades, as an industry we've been apologizing and fixing critical exploits and bugs (ex HeartBleed), that can be traced to the fact that C allows for mistakes. If a bug is allowed, someone will perpetrate it sooner or later. Sacrificing correctness and safety for the speed and complicity of C is not a valid tradeoff for the industry in my opinion.

A major feature of Swift is that it forces you to deal with error conditions and missing values. In practice you do the right thing once and early in your code, and you can write the majority of your code with guarantees that prevent major classes of bugs. Swift is not perfect, still changing, and many complain about being forced to write safe code, but it is absolutely the right move of Apple to make for their platform.

View on HN

> If a bug is allowed, someone will perpetrate it sooner or later. Sacrificing correctness and safety for the speed and complicity of C is not a valid tradeoff for the industry in my opinion.

It depends on what you are building. For an app it is not a big deal to be slower. But you will not write a kernel in Swift as you will lose performance all over the place.

Python/Javascript/Lua are used as scripting languages to create video games. But the 3D engines are written in C or C++.

Each tool has its use.

> But you will not write a kernel in Swift as you will lose performance all over the place.

That used to be the argument against C and C++ in the 80 and 90's regarding 16 bit home computers.

Any serious developer would know that Assembly was the only proper way to write software that required real performance.

Yet a couple of decades later.

> But the 3D engines are written in C or C++.

If Swift lets you override dealing with errors (think force unwrapping) then such security is pointless because "someone will perpetrate it sooner or later." In practice, what we get is an overly pedantic language that gets in the way of the developer.

Not at all.

There is a world between every single string, array and numeric operation being a possible source of memory corruption and being forced to explicitly write unsafe code.

I have been using mostly safe languages since the 80's.

They only get in the way of cowboy programming, which is a very good thing for anyone that praises quality in software development.

C would no longer be around if companies got properly sued for each CVE exploit.

People have written and continue to write secure C code, and insecure code in “safe” languages.

I have written systems in memory safe languages. The languages that provide memory safety also incur GC pauses, which means they’re unsuitable for applications where latency matters at all. (I’ve also noticed that programs written by professionals in memory safe languages tend to have many more serious high-level bugs than those written in C/C++, but I don’t have data to back that up.)

> The languages that provide memory safety also incur GC pauses

This is incorrect, you can have memory safety without a gc. An example is Ada, and more recently Rust.

And Swift, which uses automatic reference counting instead of GC. This is not a “zero-overhead” design like what Rust aims for; sometimes it has quite a lot of overhead. But it is free from the phenomenon of GC pauses.

> But it is free from the phenomenon of GC pauses.

Not really. RC algorithms can lead to stop the world in cascade deletion of highly nested data structures, and even cause stack overflow due to destructors being called.

Well, in that regard, so is Python; the GC is only used to resolve cycles, and can be disabled.

IIRC memory safe Ada doesn't allow for deallocation.

Kinda sorta cheating. ;)

It does via memory pools, RAII (aka controlled types) and dynamic stack allocation.

It isn't truly safe like Rust, as Ada can still have dangling pointers laying around, the free function is called "Unchecked_Deallocation", not sure if newer Ada has any mechanisms for better ownership semantics.

> People have written and continue to write secure C code, and insecure code in “safe” languages.

No. It's the inverse. People who are very good with C continue to have vulnerabilities in their code. Why? Because C.

Yeah, but I do have data to back up the fallacy of the perfect C programmer that writes secure C code.

https://www.cvedetails.com/vulnerability-list/opmemc-1/memor...

Apparently reviewing code before merging into mainline isn't of much help, but lets keep this myth of secure C code alive.

Σ (Logic errors in safe language) < Σ(Logic errors in C + Memory Corruption in C)

The critical difference is that in swift your have to override safe behavior by using special syntax. This means you can search for it to fix it, you can have compiler/linters enforce certain rules, you can catch it easily in code reviews. No professional team I've worked on would allow forced unwrapped code except in special well documented cases.

The default code you write in swift is safe. You spend less time worrying about its correctness, which means you can focus on solving higher level problem and less time debugging.

When people call swift pedantic, for example, and I take time to ask for the specifics, I mostly get "not familiar to me", or "I'm used to shooting myself in the foot and unwilling to consider alternatives". So my patience has run out.

If only there was a way to catch array index out of bounds.

  extension Collection {
    subscript (safe index: Index) -> Element? {
      return indices.contains(index) ? self[index] : nil
    }
  }

And now you have the choice:

  array[i] // traps for invalid indices
  array[safe: i] // returns nil for invalid indices

I always have a choice if I'm the one writing the code.

But what I want is a way to catch all errors that others may have introduced in code I have no control over. That includes arithmetic overflow as well.

What would you do? If the ordinary array subscript produced an optional value, people would simply fall into the habit of force-unwrapping it, since the hassle of handling the spreading optionals would be too big. And throwing an unchecked exception would lead to empty catch blocks everywhere, just as in Java. And then the execution would continue in God only knows what state. I simply don’t think that the type system can solve the question of trusting your dependencies for you.

What I want to do is to wrap a piece of code running in its own thread in a catch block so I can respond gracefully to any errors without killing the entire process.

What gracefully means depends entirely on the application. Often it means to log the error or display a meaningful error message if it's an interactive app, then maybe do other kinds of cleanup and shut the thread down.

It can also mean to retry later. Array out of bounds errors are quite often just a result of not properly handling an earlier temporary error.

Whether or not errors leave the rest of the application in an inconsistent state depends entirely on the design of the application.

I'm not saying that letting an app crash on buggy code is never the right thing to do. I just want the option to handle it differently where appropriate and possible (it's not always possible anyway).