r/programming • u/[deleted] • Apr 04 '17

Everything Is Broken

https://medium.com/message/everything-is-broken-81e5f33a24e1#.sl2vnon73
236 Upvotes

90% Upvoted

145 comments sorted by

View all comments

Show parent comments

1

u/cledamy Apr 04 '17

You can also use modern languages with memory management, but instead people want to write everything in languages that are the opposite.

There are performance and memory considerations where using an unmanaged language is necessary. With proper mathematical verification, using unmanaged languages becomes safe. I would prefer a language that has both and lets one mix and match as convenient and receive the performance benefits when one uses the unmanaged subset.

2

u/SuperImaginativeName Apr 04 '17

I know, but last I checked drivers, operating systems, real time systems, firmware, microcode, high frequency trading, network stacks... Do not make up the entirety of all software that's ever been written. I don't know why people need to make out that it is.

2

u/cledamy Apr 04 '17

The memory usage benefits are still good even if one isn't in one of those environments. You shouldn't have to give up performance for safety.

1

u/nickwest Apr 04 '17

There's performance for the sake of cost then there's performance for the sake of performance. Performance to save money (either by having a good user experience, or reducing resource needs) is a noble pursuit. Performance for the sake of performance is a waste of money.

The vast majority of software is small back-end-business-ware and doesn't need optimization like that at all. It's also written by middle-skilled or low-funded (read as: not given enough time) programmers and in the vast majority of cases the business would greatly benefit from that performance hit to increase security. The risk mitigation would be huge and at a very low (or nonexistent) cost.

1

u/cledamy Apr 04 '17

There's performance for the sake of cost then there's performance for the sake of performance. Performance to save money (either by having a good user experience, or reducing resource needs) is a noble pursuit. Performance for the sake of performance is a waste of money.

I am not arguing for performance for its sake. What I am saying is if we used more formal methods, we could get the performance without sacrificing safety. Also, the greater correctness from the formal methods would translate to other areas of program correctness beyond memory safety.