Hacker News Reader

Comment by TazeTSchnitzel | Hacker News Reader

I think I need to write a "C Programming Language Considered Harmful" essay. In this era, using a language which allows buffer overflows, heap corruption, use-after-free, integer overflow, and eliminates "undefined" but security-critical code, is utterly irresponsible for anything where security matters - and that is virtually anything, given the complexity and interactions in modern systems.

All code should have mandatory, compiler-enforced integer overflow and bounds checks at the very least.

View on HN

This was already clear to many of us Modula-2/Turbo Pascal developers back in the mid-90's, but then C won thanks to UNIX adoption.

- Array implicit decay into pointers instead of requiring an explicit "address of" operator

- No bounds checking

- Implicit conversion between enumerations and numeric types

- Implicit conversions between numeric types

- Null terminated strings

Every time I had code in straight C, I made it look like Pascal by validating all the parameters, compiling with all warnings enabled, warnings as errors, using ADTs with no field access to structs.

A static analyzer is also compulsory.

The amount of money caused by bug fixing in developer time, creation of C memory corruption detection tools and paying for them is just endless.

Oh, right, I forgot about null-terminated (aka "C") strings! But you'd have to get rid of them for bounds-checks anyway.

Nah.

You can deal with null-terminated strings.

You "just" have to be able to prove that all operations ensure a string remains postpended with a null, and doesn't get extended beyond the length of the underlying allocation.

UNIX and Windows adoption. I think until at least the mid-90s everyone had a "performance at any cost" mentality as well, which has now become less critical as the hardware is so fast.

C didn't had any big meaning in the MS-DOS days.

By the time Windows was starting to be developed, UNIX was already established in the industry and was only natural to take ideas from it.

But yeah, eventually it also helped disseminate C. It was by then that I moved from Turbo Pascal into C++.

I feel like that too — but then I read something like this http://thread.gmane.org/gmane.comp.version-control.git/57643... and I begin to think that may be I just feel that because I'm a OOP, garbage-collected brought-up weakling who doesn't comprehend the wisdom of the C wizards.

...huh?

This has nothing to do with C's imperative, procedural, low-level programming style. It has everything to do with safety.

No, that's Linus choosing to offend people. It's not that he's entirely wrong about portability and stability of modern C++ in 2007, and it certainly introduces a whole new wave of ways to shoot yourself in the foot, but some of the conveniences are genuine improvements.

I think many people agree with this but it's not clear how we get there with most of our critical code written in C. I think a lot of places have decided to invest in better tooling (see e.g. Clang's stable of sanitizers) as a shorter-term option while hoping that an alternative matures.

We should have settled on Pascal long ago :-)

http://www.jwz.org/doc/worse-is-better.html

Reply on news.ycombinator.com