So: I'm not saying it's impossible to write safe C. But what I will say is that if someone claims to you it is possible to write safe C, that is prima facie evidence that they are, themselves, not a person who is capable of writing safe C
@mcc Modern C++ is reasonably safe, but it is amazing how often people write C++98 even though C++11 added many easy to use features that make it easy to avoid most (not to be confused by all!) issues. However nothing stops you from writing code that is difficult to follow and has many opportunities for memory problems.
@mcc I was thinking "surely it's possible to write safe trivial programs in C", and then i remembered it's C, and i'm not so sure, maybe the standard hello world is unsafe in some circumstances. 😆
@tshirtman sincerely: if we consider the case of C++, C++ specifically, it is literally necessary to solve the halting problem in order to determine whether you have written a C++ program or not. Because the C++ language standard requires all loops to terminate, and if you ever violate this rule, the compiler is free to do anything at all without indicating a warning you that it has done so
@mcc More or less. My choice of metaphor is because I believe "prove this program is 100% safe" is equivalent in difficulty to solving the Halting Problem for the same program.
It may be doable for a specific program with some form of formal analysis but a general solution that works for all programs is likely impossible
@mcc i am willing to accept "i can write safe c but it's very expensive to write and goes through formal verification" but most software doesn't come with proofs, so
@tef The thing that concerns me most is people who are trying to express "it is possible to write C or C++ to a level of safety which is acceptable for certain applications" and word that as "it is possible to write safe C" and using the second phrase to describe the first situation is very concerning behavior
@mcc@tef Second'd! In my C/C++ work (power control systems) I try to be clear that it's possible to write safe-ENOUGH C/C++ if the system and processes are built to that end.
This means rules like "hardware MUST fail-safe by design and implementation; software verifiably MUST NOT be able to impact that; single points of failure MUST NOT exist for any control output", etc. etc. etc.
Safe enough, but we never believe it is safe. Difference between engineering and smashing hardware together.
Add comment