Hacker News Reader

Comment by jmpt | Hacker News Reader

If Swift lets you override dealing with errors (think force unwrapping) then such security is pointless because "someone will perpetrate it sooner or later." In practice, what we get is an overly pedantic language that gets in the way of the developer.

View on HN

Not at all.

There is a world between every single string, array and numeric operation being a possible source of memory corruption and being forced to explicitly write unsafe code.

I have been using mostly safe languages since the 80's.

They only get in the way of cowboy programming, which is a very good thing for anyone that praises quality in software development.

C would no longer be around if companies got properly sued for each CVE exploit.

People have written and continue to write secure C code, and insecure code in “safe” languages.

I have written systems in memory safe languages. The languages that provide memory safety also incur GC pauses, which means they’re unsuitable for applications where latency matters at all. (I’ve also noticed that programs written by professionals in memory safe languages tend to have many more serious high-level bugs than those written in C/C++, but I don’t have data to back that up.)

> The languages that provide memory safety also incur GC pauses

This is incorrect, you can have memory safety without a gc. An example is Ada, and more recently Rust.

And Swift, which uses automatic reference counting instead of GC. This is not a “zero-overhead” design like what Rust aims for; sometimes it has quite a lot of overhead. But it is free from the phenomenon of GC pauses.

> But it is free from the phenomenon of GC pauses.

Not really. RC algorithms can lead to stop the world in cascade deletion of highly nested data structures, and even cause stack overflow due to destructors being called.

Well, in that regard, so is Python; the GC is only used to resolve cycles, and can be disabled.

IIRC memory safe Ada doesn't allow for deallocation.

Kinda sorta cheating. ;)

It does via memory pools, RAII (aka controlled types) and dynamic stack allocation.

It isn't truly safe like Rust, as Ada can still have dangling pointers laying around, the free function is called "Unchecked_Deallocation", not sure if newer Ada has any mechanisms for better ownership semantics.

> People have written and continue to write secure C code, and insecure code in “safe” languages.

No. It's the inverse. People who are very good with C continue to have vulnerabilities in their code. Why? Because C.

Yeah, but I do have data to back up the fallacy of the perfect C programmer that writes secure C code.

https://www.cvedetails.com/vulnerability-list/opmemc-1/memor...

Apparently reviewing code before merging into mainline isn't of much help, but lets keep this myth of secure C code alive.

Σ (Logic errors in safe language) < Σ(Logic errors in C + Memory Corruption in C)

The critical difference is that in swift your have to override safe behavior by using special syntax. This means you can search for it to fix it, you can have compiler/linters enforce certain rules, you can catch it easily in code reviews. No professional team I've worked on would allow forced unwrapped code except in special well documented cases.

The default code you write in swift is safe. You spend less time worrying about its correctness, which means you can focus on solving higher level problem and less time debugging.

When people call swift pedantic, for example, and I take time to ask for the specifics, I mostly get "not familiar to me", or "I'm used to shooting myself in the foot and unwilling to consider alternatives". So my patience has run out.

If only there was a way to catch array index out of bounds.

  extension Collection {
    subscript (safe index: Index) -> Element? {
      return indices.contains(index) ? self[index] : nil
    }
  }

And now you have the choice:

  array[i] // traps for invalid indices
  array[safe: i] // returns nil for invalid indices

I always have a choice if I'm the one writing the code.

But what I want is a way to catch all errors that others may have introduced in code I have no control over. That includes arithmetic overflow as well.

What would you do? If the ordinary array subscript produced an optional value, people would simply fall into the habit of force-unwrapping it, since the hassle of handling the spreading optionals would be too big. And throwing an unchecked exception would lead to empty catch blocks everywhere, just as in Java. And then the execution would continue in God only knows what state. I simply don’t think that the type system can solve the question of trusting your dependencies for you.

What I want to do is to wrap a piece of code running in its own thread in a catch block so I can respond gracefully to any errors without killing the entire process.

What gracefully means depends entirely on the application. Often it means to log the error or display a meaningful error message if it's an interactive app, then maybe do other kinds of cleanup and shut the thread down.

It can also mean to retry later. Array out of bounds errors are quite often just a result of not properly handling an earlier temporary error.

Whether or not errors leave the rest of the application in an inconsistent state depends entirely on the design of the application.

I'm not saying that letting an app crash on buggy code is never the right thing to do. I just want the option to handle it differently where appropriate and possible (it's not always possible anyway).