oscargrouch

Yes exactly, it's an org that attempts to creates trojan horse implants into popular projects for gradual takeover and control of projects in the long term by the virtue of the amount of people working on it.

They should be more open about it, and stop using generic words like security and memory safety for the actual corruption of those values in the form of rewriting popular stuff in Rust (apparently Apple is making followers using the safe word 'security' like politicians use 'terror' to manipulate public opinion).

If it was really about security and memory safety, other memory safe languages would be among the projects and also attempts to fix memory safety issues in C and C++ would also receive grants.

> Will I ever rewrite curl in rust?

> I don't believe in rewrites, no matter which language. I believe in replacing code and fixing components gradually over time. That could mean that we have a curl written mostly in rust in 10 years. Or in 20 years. Or not.

https://twitter.com/bagder/status/1360131939794042884

"Here's Daniel a guy who struggle to keep his open source project used by millions working in very important big tech projects. Despite the fact that big companies use its project, he mostly get funded by ordinary people who can pay a few bucks"

"But Daniels destiny is about to change, a ORG that funnels capital from big tech companies to make software more secure is about to give him a grant"

"Here Daniel, we have a grant so you can fix your security bugs"

"Oh great, now i can invest in more unit test and have people to fix them.. and.. "

"But you will only receive the money if you or someone we pay for write those parts in Rust"

While Daniel is being payed, this is not actually/only focusing on security as an end goal, but is using security as a pitch to rewrite popular software in Rust which in the end will probably have more bugs giving the older software were much more battle tested..

So we have people with foot on big tech collect money through an org to rewrite software in Rust and not to ACTUALLY help the people doing software with very low resources to fix their software.

Daniel is saying he will still keep doing it in C. So why do this org tried this approach giving i bet whatever you want that this money invested for them to focus on security even in C would make it have less bugs, because the real problem here is economics and less the language.

Its a pity that an ORG is being used as a facade to create implants of Rust in popular projects, instead of helping out open source developers with money that would probably reach them if they did not act as the middle man to those important projects.

See their goals here, is not even about security as a whole, but memory safety, and while they cite other languages, this is clearly biased towards Rust.

https://www.memorysafety.org/docs/memory-safety/

Please dear ORG take the money from big tech, invest part of it for new projects in Rust if you wish, but really help the open source maintainers to fix their security bugs in the technology they use. Note that you are receiving this money using their projects to receive the grants. Really help them make their software more secure.

If you are really into the Rust hype, so create a fork in Rust, show that you were right.. or at least be open when collect the money to invest what your real goals.

But its a pitty, a project like OpenSSL for instance wont see a dime of this money. So sorry if i dont feel happy about this..

Just a correction: Im not implying that Rust have no virtues, it has a lot, and its a very strong candidate to write new projects into whenever you think you need C++.

I would and will consider Rust always, and it probably will make sense to use instead. If my former post implied that i dont like Rust, im correcting here, because i like it and i thinks its cool technology and that it have virtues C++ don't have.

I was saying that, specially now that the language is more mature theres a thriving community around it, it can go by virtue..

C++ is where it is now because of its "killer apps". OS's, Browser, Games, a great amount of complex software with millions of lines of code.

And they are not garbage that need to be replaced. Rust taking over by virtue will be by creating killer apps in it. Showing itself as a great replacement for projects that can also be coded in C++.

Security folks invested in Rust saying that all new code in Android will now be coded in Rust its not replacing by virtue as important things like domain knowledge and getting used to a tool is also very important, and it will probably go away. Security is just one thing that is important in a project, its not the only one. But of course if you let the security folks decide, other important aspects will not be taken into account (I tought it was a really bad move by the way, as other problems not linked to security will appear with time).

> To be blunt, the security of the software that runs so much of the world is way more important than the feelings of some programmers who feel that their beloved languages are under attack.

As someone that have created software in at least 7 programming languages, including Rust, I agree with you, i only disagree with the recipe and the tactics used.

The bugs will happen, and contrary to the constant hammering sales pitch, Rust will not escape from them. Its like saying we are free from uncertainty. Its a false promise and anyone with real life experience in big software that are not neurotic about security like someone that only see software under this perspective would do.

Now, i believe Rust will likely have less bugs in the end? It depends most of the coder, but taking that variable out of the way, its more likely because its design is more strong into that direction.

Cant people fix security bugs once they happen? this will be the approach be it in Rust, C++.. Rust still will have to wrap insecure parts in unsafe{} blocks anyway, the same way a C++ coder do only that its not a keyword.

Im all for Rust having the right to tell its strenghts, i like the tech and what its offering, i can see why it can be better, but lets take care of the language used and the ideology behind our wording, its all i'm asking here..

Its time for the Rust community to grow up and stop pitching by shaming other languages, projects and communities, as if its the only reasonable answer like as if was some sort of master-race of programming languages and everything else should be replaced because its garbage.

This is not true, and while i like the tech, im worried about how a culture formed around bullying "inferior" languages will become with time.

What is inflammatory is the way a part of the Rust community deals with other languages.

You are right is not just ISRG, but it is part of this big masonry-like movement forming to replace C++, not by virtue, but by force and politics. Unlike any other language out there that is trying to do it in a clean manner.

Android for instance was the last asset with a takeover in this hostile manner, no other language out there ever did before. Despite we have tons of other safe memory languages out there.

I cheer for Rust the technology, to grow, but lets care about the language, because its not enough we work so hard to make things work, we still need to feel miserable, no matter the things you have done, because you are not using a pink t-shirt (one vector on a multivector of preferences and goals).

Is the end there is much more details into why we choose X and Y.

A lot of C and C++ code are out there, and with them a lot of great knowledge. man-years of work, of life into them.. they are wonderful pieces of engineering, and yet, just because they are "not written in the right language ™" it will force by culture and not by virtue that they get kicked off like garbage.

This is totally disrespectful, and most of the time is pure marketing and salesman pitch. Rust has yet to prove itself in a lot of fronts, and this will only happen with time.

I've seen Daniel being constantly bullied to feel miserable for having its tool in C, in Twitter, in mailing lists.. and he is just a sample..

There's no "language to rule them all". Java already tried and almost ruled the world, but reality is that with options languages take here and there to whats important to them, they will never expand to a certain level.

Languages compete in their axes, which for me there are mainly 4 big ones:

a) System/Performance/Control: C, C++, Rust, Zig

b) Application: Java, C#, Swift, Go, Kotlin, Nim

c) Script/Casual: Python, Ruby, Lua, Javascript

d) Domain specific: OCAML, Scheme, Haskell, Matlab

I've never seen a language ruling in two axes at the same time (as in you can use it for the same goals), let alone in all four, or at least three.

The a' axis are very hardcore languages with insane amount of control, but they will never be as productive as the b' and c' axis.

Meanwhile the b' axis is the most popular one, as they allow you to create big and complex application while being productive. Their runtime are not far away from the languages on the a' axis.

The c' axis is most productive and easy to pick up, with languages that feels more natural, but they dont have the performance of the a' and b' axis and also its hard to compose big applications on them unlike the a' and b' axis.

Maybe a successor of languages like Rust and Swift might be the on to do this, but i cant hardly see Rust in that position because programming in it have more or less the kind of productivity that C++ gives you.

I relax much more when i can write something in Swift instead of C++ or Rust for instance, and i would mostly choose it given the perfect match to the problem i'm solving.

I think we are going for a more polyglot world, not less, and i mostly use C++, Swift and Python when i can, where you can replace C++ for Rust, Swift for C# and Python with JavaScript according to your personal tastes.

But using something from one axis trying to reach for the goals better served in another axis is mostly a "when all you have is a hammer.." kind of paradox.

When i see this kind of discussion here and in HN i think it mostly miss the primary point..

You would be more to the point if we were talking about the industrial era which can automate even the experience into machinery.

But things like software are heavily based on knowledge retention.

Knowledge retention is about attracting talent, and make sure they evolve their knowledge and keep that knowledge there.

So you need a good quality of life, career and financial possibilities, good universities, a good culture with individual freedoms.

Its all about the "human gold". And the countries that will retain this sort of talents are cannot be optimized to also be industrial powerhouses, because the balances are different.

Anyway remote labor will change things a lot also, and we will see how things will turn out. But work and quality of life balance will become really important, and industrial sweat shops wont be as attractive in my opinion.

I hope that talent get more spread out instead of concentrated as is now, giving we are going more remote..

Anyway, i guess a lot of parts of EU will become more palatable as the physical place where you are at become less important.

I predict that small towns in Italy, Portugal or France with mostly old people will get more trendy giving the houses will be more affordable and people will be able to create their kids in a more healthy environment.

Pandemic will change faster the assumptions we had about how we should live our lives, and i think loneliness will hurt us more as the value of money compared to what is lost by pursuing it will become less appealing.

The industrial era wisdom will get reviewed and some things wont make any sense anymore. (For instance, packing too many people in gigantic towns, lowering the quality of life, country life will get more trendy with time in my opinion, people living in small communities of 20 families in rural areas)

When the web was there, it had no historical record to rely on, everything that happened was unprecedent in history because it was the "killer app" of the internet, and by virtue of being the killer app it made the internet something people want.

Now in 2021 we have a lot of historical records of how things shaped and get in the way they are now. Everything that you are saying about the Gemini is exactly how the primary web was in the beginning and yet it changed because a lot of forces happened.

I completely agree that the Web now is a whale and its too fat (BTW this is the point that Gemini is getting right), but i don't agree with the approach at all, as its not possible to have a time machine and make the technological status-quo get back to were it was in the nineties so a project like Gemini can be a successful branch of WWW.

A "skinny web" standard would be much more useful, and here i think that Tim Berners Lee is missing the point by creating something like Solid instead.

Anyway, its a chance missed to point to something for the future, pointing to the past instead and making a lot of good folks lost by following the wrong way.

I consider Gemini part of the "retro technology movement", that while cool and while having its heart in the right place, miss a nice chance to help us all change a very dark future ahead of us of digital feudalism imposed by the big tech goliath monopoly.

We, the tech crowd need to step back and stop following them into that bleak future, Gemini is subversive in that sense, but while the goals are great, its alienatory nature negating the status-quo and forgetting to learn with historical events its not a step into the right direction.

But if at least take some people away from the WWDC's and Google IO's, at least it will be a little bit less people into this army that is leading us into this dystopic future we are heading right now.. and i just hoped that Gemini with a little more contextual knowledge could be at least a stone in their path.

Facebook was cool before it allowed to post images and the same goes for reddit. Once the multimedia content was allowed, the incentives changed, the crowd changed and things started to go downhill..

Take a look at HN, no images or videos, so it tends to bring more of the literate crowd.

This is funny because the only way for Gemini to keep that way, is by not becoming popular. Because that's exactly what happened to the web.

It was also an idyllic place in the beginning that got crowded, and giving we didn't figure it out the next step beyond capitalism the trash from our material world started to fill the digital realm because we are still in the same culture.

So to solve the problem Gemini is trying to solve, is not by fixing the web standards, but by fixing our culture, which is a much harder and bigger problem.

Gemini will want to keep working, than it will figure it out a way to sustain itself economically that in turn will make it possible to create profitable services on it, and it will be just a matter of time to become exactly as the web is now.

If it doesn't take that path, giving the Web is a superset of it and it doesn't provide a unique value on its own, it will probably fade away or keep very niche.

That makes sense. But i wonder if two teams creating a port, one straight from the C code and the other with the translation output..

Which one would end first and with the best version..

(Not sure if doing this from the transpiled code is the best option, giving you will miss a lot of otherwise informative context in the original source)

Reading at the transpiled code, theres something that make me a little worried if this becomes a trend. The lost information in the process. I guess if there's an AI in the middle, capturing the logical context and later helping into the translation process.

In that way the power of the source code to teach us will still be there.

I understand if some tool that is in C and need a boost in security might use this, but giving the output code is intractable, they would still have to code in C, so this kind of defeat the some of the goals of writing code in a more secure environment.

Its important to understand that security is just one of the axis of a whole that have much more things to consider.

Having said that, maybe there will be a good use for source code in C that needs a safety boost right away in critical places, or use something like this to spot dark corners and fix the code back in C.

Also, great hacking points to whoever did this, as this is fun just because is hacking at its best.

I think WASM will have a great future in the cloud, giving cloud providers can offer their services in any programming language their users want, running in a secure sandbox.

But i'm not so sure about personal devices. It would be very hard to beat Javascript code on the Web in general. So i dont know about the general purpose target future in that case, i think it will flop, except as a fancy accelerator or to virtualize things that was once outside the web.

This is like a car company that also have a tire company, also providing the tires. So far so good, but the company that makes the car only allow you to use its own tire brand, no others are allowed.

How legislators can easily spot problems in bad company practices that forces monopoly in material objects but are so obnoxious to everything digital?

I see even tech veterans here struggling in seeing that there's a big problem in all this..

Its like Microsoft not only shipping IE with windows, but making web sites slow in other browsers on purpose so at least in Windows nobody would use the IE competitors.

Why Apple is getting away for more than 10 years to such shady practices is beyond comprehension.

And this is just one of them.

I'm used to fix and understand issues in big C++ codebases, and while eventually use a debugger, i feel that printing while passing is much better because you can see the bigger picture.

Is like putting a bell in each step so when the running bunny passes over it rings.

Later you see every place the bunny passes over and what it did, i feel its much faster to grasp and understand whats happening.

Debugging feels very slow, and i mostly use it to analyze core dumps. Also in multi-threaded/multi-process code it can change the result/output as other parts (like processes) might still run detached from the debugged thread.

Anyway, i don't like forced rules, you should use whatever works the best for you, because in the end we all have a intelligence to analyze things for our particular scenario much better than someone with a generalized point of view can.

We should always be open to learn and to see other perspectives but once we are settled we should also learn to trust ourselves and bend the "rules" when there's a need.

Heartbleed happen because the open source software used by everyone were left getting dust, with low maintenance and despite its popularity, nobody was paying or donating nothing to keep the project going.

Even if Rust was invented in the 80's, and such a project was in it, the same could happen in one of those unsafe{} blocks a Rust project like this might need to use (and we are forgetting all the ordinary bugs even in the safe portions of the code).

Sure, being in C might be a part of the problem, and this is a good space for tools like Rust to occupy more space, but there's a bigger picture or else Linux would be breaking all the time, and its a solid, big and complex piece of software that works pretty well because there's a lot of economical incentives to keep it going.

> As an American, please accept my apology for all uninvited interference in the economic and political affairs of other nations.

No need for apologies. This is all super complex, gigantic, out of our hands mess that is hard to make it advance even a little. I know how it feels.

But its good to know that you care, and that's the reason why we should never fall for cheap generalizations.

That's why Biden while being a relief to north-americans(and i completely agree) its worse for the rest of the world at least from the perspective of enforcing north-american policies and legislation worldwide (read big-co, intelligence agencies).

Given Trump focus on the internal affairs of the US, while the political climate was toxic at home, at least it let all others breath a little.

Now with Biden it will star all over again.. North-american companies, intelligence agencies, basically the status-quo interests being enforced all over..

At least now the government is caring about the environment and as while at home the policies are more left-leaning, i bet the will not be the same for foreign countries, and i expect things like copyright enforcement to gain more strength (basically all the traditional corporate and government bullies)

From the perspective of international political affairs its the resurgence of the good'ol "United Corporations of America" policy enforcement.

Its not just that. The experience of the teams also counts.

For this kind of project its more important to have people with pratical experience in kernels, than experience in a particular language.

These people will have a experience in languages they used before, so even if the decision was taken today, you wouldn't find enough people with experience in kernels AND Rust, but will have much more people with experience in kernels C and/or C++, so C++ would still be a good default in comparison to C.

It would be pretty amateurish to get the kernel expert folks to learn Rust while implementing it, as it would probably mean that the end result in Rust would be worse than the end result in C++ as they were more comfortable and experienced in that language.

It will take more time to form specialists in some key areas so that decision can be made with less side-effects.

Yes, the famous post is old, if i recall correctly is from 2004, so its addressed to the C++ 98 and style that was in vogue back then.

Take some vintage C++ code from late nineties, like games, and there's no concept of ownership, before smart pointers and move, and full of global's everywhere.

It was also when code were transitioning for a multi-threading era, so using the same code style of the previous sequential era was really bad.

I didn't even remember this, OMG.. VBScript that used to ship with IE and could be used instead of Javascript.

We are so lucky that Bill Gates missed how important internet would turn out to be..

I've saved a startup once from going bankrupt more or less like this.

They were paying a lot for ASP and a shitty product(cant remember the name..it was something like WebObjects) that was taking too long to load, the newly born company i was hired for would cease to exist, so even thought i was hired as a sysadmin to manage the network, linux and databases, i've used my low skills as a programmer, without nobody asking me, and designed the thing in secret, in about two or three weeks with PHP, Linux and MySql instead.

The (news based, with a lot of personalization page) loaded in about 400 milliseconds instead of what once was a 10 seconds load.

My bosses were a little skeptic at first, because the ASP folks was a team formed with university professors and skilled pros, and i was a teen that was not even hired as a coder. Also it was so much faster that they thought i could only be cheating somehow (like static instead of personalized with data from a backend db)..

Linux and open source was also faced with skepticism, specially when confronted with Microsoft stuff that everybody was used to back then.

The LAMP stack was a wonder back in those days, and it helped a lot to popularize Linux, MySQL, Apache and PHP. I know today PHP doesn't look so cool giving all the other players, but in the context it was launched it was so much better than all the status quo of the nineties where the options were quite limited.

I guess you are lacking some context.

Back in the day, you could:

* Be bold enough to use Linux or FreeBSD and use CGI or Perl as the only free version

* Use ASP but pay license fees for Windows NT, ISS and SQL Server

* Use ColdFusion which was kind of trendy but was pretty expensive.

When PHP arrived it was so refreshing. I used to make my stuff in Apache+PHP, MySQL and Linux and it was magical what you could do with very few lines of code.

The worse part was to manually get the sources of the dependencies one by one, hit ./configure and make, so you can compile a php module for Apache

In those days Microsoft was pretty strong, everything used to be closed source and payed and that's why for people who understand what it was back then, this does not sound like the splashy announcements of today.

That's why every time you see Linus, Stallman or any person that was active in the open source movement, you should pay a beer to them. The world of technology owe a lot to them, specially the underdogs.

Its not also about user needs, given the final application will have access to more functionality, also guaranteeing things will work.

I agree that Electron is user hostile in the way it uses memory, but there's an answer in between the Electron and what Tauri is offering here.

Tauri could have a embedded engine and yet propose a better architecture and better use of memory in consequence. The best of both worlds.

In Chrome for instance, each tab is equivalent to a app, giving is a whole isolated process and yet it doesnt kill your machine even with many tabs open.

I'm not saying that Rust is not a good language for UI, and im also not saying UI is simple. The problem is that you are just comparing it to JavaScript which is untyped and easy to beat.

In my case i'm comparing it with languages that are also powerful, safe, fast and more well designed for this kind of scenario, which JavaScript or Python aren't.

But if i had just two picks, between JavaScript or Rust, of course i would choose Rust without blinking. But once there is more options.. (in this case you can read my comments above).

And i agree with you, that if you sum it all, maybe you get more productive (as in ready to ship) in Rust than with JavaScript.

Its unnecessary complexity for the paradigm we are talking about, that is user facing, mostly UI applications.

Its necessary for system programming, and as we can see people talk about it whenever C++, C, OSes, Browsers, Games, etc.. are being talked about because it works really well in those domains.

But when you are building a UI, C#, Kotlin, Swift, Typescript and even Java are much more productive with good speed, safe (even safer than Rust), and with language constructions that map really well to this domain.

Rust achieved a very good set of features, but unfortunately the price is its complexity, which is a burden you don't need to take when you are creating UI's.

Sure you and i (im mostly a C++ dev) can use it to make UI's, but unless you are creating something really complex that needs every drop of performance and memory, like big Games or a Photoshop, you don't need this productivity and HR tax(its much harder to find people in C++ and Rust) that languages like Rust and C++ ask of you.

There's no such a thing as one language to rule them all, and Rust will not the best candidate for domains it was not designed for. Swift for instance is much better at this and with a very good performance, where it would also be a good fit for a Photoshop clone or a browser.

I'm finishing this (no XUL tough), but the first impl(developer language) is in Swift. But the runtime the Swift access is pure C shims, so any other language can benefit from it.

If anyone is interested, it would be much easier to create those bindings to Rust. I'm super interested (and i would probably create a Rust SDK anyway) and there's a lot of other bonuses that neither Electron or Tauri can offer (as i target it not to be "just" a web-based app platform, but something that also had the soul of web browsers, by forming networks, addresses, etc).

If anyone is curious, there is more disclosure in another answer on this same thread.

i would love to give new all of those cool new languages that need a platform to thrive: Rust, Zig, Crystal, (and while not new) Python, a chance to have a 360 ecosystem, so we can stop being hostage of just Javascript being used.. and no, WebAssembly is definitely not it, as in the end it will give Javascript access to FFMPEG and the likes making it more prominent and ubiquitous

Its like this: You have one manager process and one GPU process for everyone. (Mind you that this is chrome based, but its quite modified i must say).

Then for each application: You have a "service process" which is instantiated and is always running, this process asks for the manager to create its rpc service server. Then every rpc call is routed to it.

This application service process is already coded by the developer so he defines what every api does and also how it respond to resources like pages, images, videos, etc.. (it also uses RPC by default to route resources.. but its through HTTP/2 giving its gRPC/Protobuf)

This process, totally in control of the dev code also can hijack its own application launches, so its in charge of app launching and killing (from its own scope)

Then theres the UI process which is akin to renderer and its also coded by the dev, where the renderer is in Swift so totally customizable (Imagine being able to control the C++ renderer events, lifetime, frames, etc.. of the chrome renderer process; in this case you do, with Swift), giving you have a lot of power.

The developer control, codes and ship the service and the ui app. Once its installed, even without any UI, all other applications can consume its services over its RPC api, because there is a 'service process' running and serving those requests (imagine being able to deal with twitter or a google search api (all local and with the same tech) from your app that is specialized in something else)

> Do you need / want any help?

Yes of course! How can i reach you?

I'm doing this.

One difference is to be able to ditch Javascript and use a native language(Swift is the first one) to talk directly to webkit.

The other difference is that the apps are "managed" as Chrome manages the renderer process, so in the end you have one manager process and one service process for each app and many process for the UI apps.

The problem with Electron is that for each app, it will need many processes, and if you have more than one Electron app running, it will eat all the resources.

With the architecture proposed, it will be more light as there will be just one instance of the manager processes, and unlike Electron they would not be isolated as they are all centrally managed, also the fact that it wont need to use JS, will also put less pressure on memory resources.

It also uses RPC so that every app have a API that can be callable by others. This in turn can make it form a "network of apps" where the applications can consume the apis of the other apps installed. The RPC service is local first, but can fetch things in the "cloud" if the application needs to.

For me this is my take on what "Web 3.0" should look like.

I have a 0.1 version here and i'm just finishing the final touches before launching it..

Edit: Also i forgot to mention that the distribution of the application and resources(database and files) is over torrent with DHT routing, so you can share a unique address and serve your own applications over internet without depending on domains or a third-party hosting it for you.