skysight-inc/HackerNews huggingface dataset:
Some small steps could have been made years ago.

For instance, getting rid of unspecified order of evaluation. Or defining a dialect of ISO C in which evaluation is strictly left to right, and making support for that optional (so then your local GCC or whatever can have -fstrict-iso-eval to turn it on).

Another example of "small stuff": catching negative values being passed into the <ctype.h> functions. Also, all the instances in the standard library where a null pointer invokes undefined behavior could be required to abort the program.

Some undefined behaviors cannot be made defined without a lot of overhead (like catching all out of bounds pointers).

However, there is a lot of "low hanging fruit" undefined behavior where things can be improved.
I wasn't sure whether or not it would print out a warning, so I tested it. With g++ 4.8.4, there is no warning printed, even with `-Wall -Wextra -pedantic`.
A classic example of trying to define behaviour regardless of what all the different hardware does is Java choosing IEEE754 floating point. Which isn't natively supported on x86.

https://www.cs.berkeley.edu/~wkahan/JAVAhurt.pdf

If C had standardised to the idiosyncracies of the PDP-11, it might have held back its development.
The really sad thing is that these are the kinds of issues that Apple could change in about 2 days with a couple of developers. App Stores lack some simple concepts that would go miles toward making developers more money, such as:

- If the app costs more than $0.99, it can be downloaded for the tryout price of $0.99 and returned within 2 days without paying more. If you keep it any longer, you pay full price (e.g. $6.99 or whatever).

- If the app costs $0.99 or less, purchases are final.

- Developers can charge for upgrades from a previous version, not exceeding 25% of the original purchase price.

Maybe there are rules that would be better than these but seriously, why aren't there at least options like these?
I love Rails. And in 2014 I wanted to build a very specific type of realtime app with Rails. I used Faye-websocket and Redis and got everything working with Puma.... and it fell flat on its face.

I learned enough Elixir and Phoenix to be dangerous and built the same thing there in about 2 days with much, much better performance. I've been working on it since.

I don't see myself moving away from Rails for most things I write because it's just more mature and suits my style of coding. I disagree with the way the developers of Ecto (the database adapter for Phoenix) are approaching things, so if I have a web to database app, it's Rails all the way. (Their decisions aren't bad. I just don't like them and that's my problem, not theirs.)

But if I have to do anything that deals with the realtime web, I can't think of anything better than Phoenix. I'll get over my issues with the DB layer and get stuff done because Phoenix channels are awesomel

This is a long winded way of saying "you should really look into Phoenix." :)
Yeah, but in Ada's case it would look like you're going the other way (to { }).

[edit: folks really shouldn't down vote kevin_thibedeau, he is correct after all]
I wonder if this is true. In spite of doing well on measures of intelligence (particularly verbal) I was not an early reader.

edit: I had no patience for it but would spend most of my time building things out of wood/nails and legos.
I completely agree. I was, instead, trying to give an example of why a compiler can't just "detect undefined behavior" as the grandparent suggested.
The cold fusion horizon
A huge part your argument comes down to "it will all be the same as now but magically better" but you didn't bother to make a case, just list out some very assertive predictions.
I think you're missing the point. The issue isn't that every student can't go to Berkeley, it's that identically qualified students students can be charged 500% more for the opportunity purely because of geography. I suspect this disparity might actually be weakening the "prestigious" nature of many schools given there is now a monetary incentive to accept unqualified students if they are out of state (or even out of country for even more fees).
Let's not forget that Lektor solves actual problems. Show me another CMS that offers:

- Static HTML export with elegant dependency tracking by design (reducing attack vectors and maintenance cost on the frontend server)

- Admin interface (I can't tell a non-techie to connect via SSH, fire up vi and run Jekyll)

- Flexible content structure (Title/Author/Content doesn't really scale beyond a simple blog)

- Elegant design and implementation (I could do anything with WordPress and half a dozen plugins, but I fail to even find a bare-bones theme without kilobytes of code that I will never need; the whole ecosystem revolves around the novice user who understandably prefers "quick and dirty" over touching code)

I have been looking for a CMS that fulfills these exact criteria for quite some time. Lektor looks ideal for projects where the developer prepares a non-trivial page structure (think book listings, music albums, anything that goes beyond bold and italic), but the client should be able to edit content. Thank you, Armin!
> It's a label that helps people.

Yes, that's very likely true. But some will argue that it's more than a label, that it has an independent reality, whether or not people find it helpful. Such people are trying to class autism with biological conditions, and they may turn out to be right. We won't know until someone uses science to link an actual objective cause to the symptoms -- a pathogen or an unambiguous organic source that can be objectively diagnosed without expert opinion playing any part at all.

We're nowhere near that goal.

> When I finally had a psychologist tell me about Asperger's, and I went to some of the online communities and read about all of the other people with such similar experiences, it really helped.

How did you feel when Asperger's was abandoned, after an epidemic of phony diagnoses? Did it matter that many of the diagnoses were just opinion with no objective basis? This is not to claim that those with the Asperger's diagnosis were faking, but that their true subjective mental state wasn't being accurately assessed, and many smart people were being grouped with people who actually had one or another mental condition.

I point this out only to show that we have no idea what Asperger's is, or Autism is, and the necessary science is not being done.
Static code analyzer PVS-Studio has now C# support
PVS-Studio used to be known only among C/C++ programmers. This is an analyzer that finds bugs on the phase of writing the code. The number of diagnostics increases every day. It is also useful to search for typos and errors caused by inaccurate Copy-Paste method. Articles about open-source project checks clearly demonstrate the abilities of the analyzer - http://www.viva64.com/en/a/0084/

A very important event happened. Now, starting with the 6.00 version of our analyzer tool has C# support. We invite C# developers to try it on your code with the help of this analyzer. Download page: http://www.viva64.com/en/pvs-studio-download/

I understand that this is an advertisement text. However, the event indicates a new phase for us, so we would like to make it known to C# developers. I’m sure, the tool will be useful to a wide range of developers.

We would like to get feedback from the developers about our new tool. We would be grateful to anybody who will find time to try PVS-Studio in the project and write to us about the flaws and ideas about the implementation of new diagnostics. Feedback page: http://www.viva64.com/en/about-feedback/
That's shoddy programming - it obviously contains an error.

As someone who compiles with "-Wall -Wextra -Werror", I believe that this example program shouldn't even be allowed to compile, even though the standard allows it.

The variable should really be initialized explicitly, which shouldn't be expensive at runtime.

int i = 1; /* or whatever */

Alternately, if the programmer intended to only print when some_big_complicated_function() return true - which is a strong possibility because they only wrote a value to "i" for that case - then the bug is in the position of the printf and possibly the variable definition, if you're using >=C99.

#include <stdlib.h>
#include <stdio.h>

int some_big_complicated_function(void);

int main() {
if (some_big_complicated_function()) {
int i = 0;
printf("%d\n", i);
}

return EXIT_SUCCESS;
}

> the resulting program would go much, much slower due to all the checks.

That depends on a lot. It can be (very) significant if you're talking about the middle of a hot loop; in the given example that runs once per main(), the difference is negligible.

For better examples and a discussion of why it can be very hard to issue useful warnings when optimizing around undefined behavior, see LLVM's series of articles that should is mandatory reading for anybody working with C/C++.

1/3 - http://blog.llvm.org/2011/05/what-every-c-programmer-should-...

2/3 - http://blog.llvm.org/2011/05/what-every-c-programmer-should-...

3/3 - http://blog.llvm.org/2011/05/what-every-c-programmer-should-...
> Of course, as with any gift exchange, the real goal is to win.

And that's where these things lose me. Turning a community event into a competitive event.

And yet, in many places, if you don't participate, you are viewed as shunning the community.
I didn't grow up on Star Wars, even though I was the right age to have at least seen ads for the third one. I don't remember it being an unusually big deal where I grew up -- no more so than E.T., for instance, which we never hear about anymore. Or Close Encounters, which I think was big when it first came out but was a little before my time.

Anyway, since I didn't grow up on it, there's no nostalgic connection for me and I'm not into it at all.

(Whereas I'm at least somewhat aware of the Star Trek goings-on because I was exposed to TNG by television.)
1. A combination of public education and technically viable alternate funding streams will destroy VC/registered corporation modes of capital/motivation for a greater number of talented developers able to harness public interest. This is the biggest change: social.

2. The remote gig thing will begin to dissipate.

3. The Chinese RMB will be a global reserve currency and the Chinese international banking system will offer a viable alternative to SWIFT. More of the world will have adopted the IBAN, the US will still have its head in the sand. More people will leave western countries for the developing world, where overarching government surveillance and cost of living concerns do not encroach on daily life, and education and political stability have improved.

4. The biggest technology shift will be the mass adoption of wireless ad-hoc/mesh networking. The biggest losers will be mobile carriers and government surveillance, who will push hard politically to ban such direct communication between citizens by asserting that such communication is dangerous and that only terrorists and poor people have [this mode of] conversations.
> I'd like to see a free C compiler that clearly defines, and permanently commits to, carefully designed semantics for everything that's labelled "undefined" or "unspecified" or "implementation-defined" in the C "standard".

That wouldn't just be a new compiler. That would be a new language. I dont think there are any short cuts to fix C.

C++ is doing something somewhat similar with the "C++ Core Guideline" rules, which are designed to be checkable by static analysis tool. The long term goal is that eventually C++ will become a safe subset, when all the error-prone parts of the language have replacements.

> "Following the rules will lead to code that is statically type safe, has no resource leaks, and catches many more programming logic errors than is common in code today. And it will run fast - you can afford to do things right."

https://github.com/isocpp/CppCoreGuidelines/blob/master/CppC...
Assume p is a pointer. Then this is possibly invoking undefined behavior, unless the compiler can prove that p will never be NULL:

*p;
There's a blog post[0] from Chris Lattner from a few years back that touches on this.

The summary is: "People often ask why the compiler doesn't produce warnings when it is taking advantage of undefined behavior to do an optimization, since any such case might actually be a bug in the user code. The challenges with this approach are that it is 1) likely to generate far too many warnings to be useful - because these optimizations kick in all the time when there is no bug, 2) it is really tricky to generate these warnings only when people want them, and 3) we have no good way to express (to the user) how a series of optimizations combined to expose the opportunity being optimized."

[0] - http://blog.llvm.org/2011/05/what-every-c-programmer-should-...
> I also object to the presupposition that there is secure software and non-secure software.

I'm with you 100% here. Especially without a more precise definition of what we mean by "secure".

> In most practical cases, it is impossibly hard to tell in which class an application falls, so it would be better not to make that distinction at all.

Unfortunately, it seems that it's really quite easy to tell. Unless you have overwhelming evidence [1] that says the software is "secure", it's almost certainly going to turn out to be insecure.

[1] For example: seL4 and its proofs of correctness http://sel4.systems/
You're trying to outsource work you charge $60/hr for, at 1/4 to 1/2 the cost. That's a lot of markup, given that you aren't having to actively find work, deal with potential bad clients, etc.
I don't know if it's guaranteed to bark on all possible cases of UB, but there we go:

$ cat test.c
int main() {
return *(int*)0;
}
$ gcc test.c -fsanitize=undefined -o test
$ ./test
test.c:2:9: runtime error: load of null pointer of type 'int'
Segmentation fault

I'm pretty sure I've seen similar tool based on clang as well.

And there is valgrind.
>* There would be no superconductive magnets.

Can you expand upon this? I'm unclear as to which of Einstein's theories you are referencing.

https://en.wikipedia.org/wiki/History_of_superconductivity
If you want to have a language be a "C killer" for secure software you need to put a lot of emphasis on simplicity and portability, which are not strengths of Rust.

I think that if you get rid of raw pointers and type casts, you are able to avoid most undefined behavior with dynamic checks: bounds checking, tagged unions, etc. The notable exception is concurrency bugs, which are hard to avoid without a restrictive static analyzer, but I think there is an argument to be made that perhaps the kind of code mr Bernstein wants to write is better off with "boring" sequential algorithms.
At this point you pretty much want an alternative language more than a compiler: one that looks like C, but is completely defined. And this makes kinda sense, yet is IMO still quite dangerous (less than the actual situation but still too much)

1/ There are tons of people who will say: "this project is written in C" instead of the reality that is that this project is written in boringC, (actually probably even most of the projects authors will) and will for ex. compile with a regular C compiler instead of a boringC one, maybe for performance improvement...

2/ You just can't take C, even with a completely defined semantics, and call it a day for secure programming. It would still be filled with crazy features that are intrinsically impossible to render secure (everything about C "arrays" comes to mind)

So let's take this idea to its real destination and rewrite secure projects using a really secure programming language, instead of just extending the current mess for 30 more years.
Cisco: Update for Customers Following the Juniper Security Bulletin
Lots of off-the shelf "smart plugs" these days, with varying degrees of open-ness and convenience to their APIs.

Or for DIY, a cheap micro plus a opto-isolated relay board.
"We've put all our eggs in this one basket, which cannot possibly go wrong"
I bet you'd enjoy http://www.amazon.com/Your-Code-Crime-Scene-Bottlenecks/dp/1...
Yeah I know. I'm a little more flexible with what I'm willing to pay, but I know there will be a lot of management on my part, so some margin has to be there to make it worthwhile.
Software has diseconomies of scale – not economies of scale
Why can't reading and learning be part of being a kid?

OK I'll admit dorkiness in public, I loved Tom Swift books when I was a little boy. Couldn't have had my childhood without reading Tom Swift books, wouldn't trade it for anything. The first book I ever sat down and read front to back was the one with the triphibian atomic car. I was probably about 5. Do not want to hear bragging along the lines of "my first book was the Silmarillion at age 2" but I'm sure this was not a unique childhood experience, especially here.
I can't believe it's not butter.
The problem is that undefined behaviors are used for valid extensions. "Undefined behavior" doesn't mean "error".

For instance including a platform header like #include <fortran.h> is undefined behavior. ISO C has some requirements there: if the header is found, then the directive is replaced with the preprocessing tokens from reading that header (and so if there are syntax errors there, they have to be diagnosed, and so on). But ISO C specifies no requirements as to what <fortran.h> contains, or whether it exists. On one implementation, it might cause the rest of the translation unit to be treated as a Fortran program. On an other implementation, it might bring in some declarations related to a Fortran interoperability. On yet another, translation might stop with "header not found: fortran.h".

UB is simply "behavior upon use of a nonportable or erroneous construct, of erroneous data, or of indeterminately-valued objects for which [ISO C] imposes no requirements".

Nonportable is not necessarily erroneous!
I'm someone currently in the process of drinking the Rust kool-aid, in part because the goals of the language are very closely aligned with what Bernstein proposes here. Further, because of the memory model, the compiler can produce quite competitive performance while still preventing the execution of any undefined behavior (related to his last strawman in the bullet list).

I get that even if Rust offers a panacea to the issues he mentions (which it may or may not, I'm no expert), there's still an awful lot of C code that would need to be deprecated and rewritten. But surely there'd be value in efforts to get away from a language that has such a loose standard?
Selectric bug
Tests can show the presence of bugs but not their absence. The idea here is to create a compiler for C (or perhaps a C dialect) so that nasty undefined behavior is guaranteed to not occur.
> You are misunderstanding me( I know sit seems to be a common pattern for you)

Then maybe you should write a bit more clearly. The opening line of this whole thread is you quoting a single line out of context, stating you disagree with it, then providing evidence that you probably should agree with it and that in fact you act contrary to your stated position. To me that makes no sense at all.

> whether I stand behind what I say is totally separate concept from your motivations and how they reflect on you as a person.

That's another thing I can't make sense of. Probably my fault.

> The quality of my technical reputation is not in question here and my employer is welcome to read this thread.

Excellent.

> I didn't call you an "alarmist" I said worrying about whether amazon will stay in business, "get hacked", or if S3 is going to disappear without warning is "alarmism"

I never suggested Amazon would go out of business, you made that up all by your lonesome. What I wrote is that your control panel could get hacked which is an entirely different thing.

I never suggested S3 would disappear.

I also never suggested that Amazon (the company) would get hacked.

Even so, there is a remote possibility that all of the above (which you just came up with) would become true at some point in the future. But I purposefully did not allude to any of those because the chances of those happening are remote enough that for me they don't count as reasons to have a back-up.

> They were responsible for 39% of all commercial internet transactions last year

Who cares.

> and store 2,000,000,000,000 objects.

Doesn't enter into the equation at all.

> If they go under we are are all in a heap of trouble.

Well, you probably will be.

> A NAS device in some remote part of the netherlands isn't going to save us.

NL is small enough that we don't really have remote parts. Besides, none of those situations are the ones that I wrote about in my original comment. You really have a hard time in the understanding department, first with the original posting, subsequently with my comment on yours and further on with several other people in this thread.

When you feel everybody is acting weird or seems to be unable to understand what you are saying: consider the problem is at least partially on your own end.
But that is the thing, undefined behavior just says that the compiler takes no position on what should happen. So a boring compiler that refuses to compile code which would have undefined behavior is sufficient. It makes idomatic C a bit more challenging but if you've read through Dan's code you know that he's all about picking a style and sticking with it. And for that set of constraints, its all defined (and boring because there is very little, if any, optimization going on insider the compiler)

So sub-optimal but predictable and safe code given that you change the preference bit to safety over speed.
Typescript just delivers a better quality level of code within a large group of developers.
Uber's Rival Lyft Plans to Raise Up to $1B in New Funds
So what is the body of knowledge that legitimatizes them as technical terms? Or are they just 'sign posts' to things we all experience (a.k.a. same level as Tolle, Chopra, et al.)?
"Since the last release in 2013, users were facing compatibility issues with Java, which have been resolved with this release."

Finally, I've struggled with this for months on a few different computers.
Meet Google Capital, the Investing Arm with the Keys to the Googleplex Kingdom
Bacteria that resist 'last antibiotic' in UK
I don't think this can be done with C. Really

- Remove all possibilities of memory aliasing. Only exception might be when reading from devices/network (some kind of boxing, unboxing)

- All array accesses are bounds checked.

- Checked conversion between int/unsigned int and different sized items. Converting a char into an unsigned int? Be explicit in what you want to do

- No pointers "flying around", unbound to types. Have reference-counted objects at least. Allow a way of passing a sub-array without copying/with read only permissions.

- Remove "gotchas", like ordering of statements, assignment on comparison (unless it's obviously correct), no "compiler dependent" behaviour, no "undefined behaviour" (unless it's machine specific)
In case there was a misunderstand, I used "secure software" as it was used in the title to mean software that is supposed to be / needs to be secure.
... the headers trigger storing into the edge cache.
Deploy Magento 2 to Digital Ocean Using Tutum
You still get redis as a dependency if you `--skip-action-cable`. Seems... odd.
Undefined and unsafe are separate concepts.
Also at a higher power usage as well.
24 Data Science, R, Python, Excel, and Machine Learning Cheat Sheets
Your message's clarity gets muddied by your overzealousness I'm afraid.

It's absurd to say that I am "actively trying to do harm to innovation." I filed for patents on novel processes to protect myself. That's inherently defensive, not offensive.

Smart people can disagree on this topic. I understand that a lot of people don't think there should be software patents, or patents at all. I don't think it's that simple.
Thanks for the clarification -- it looks like I had the wrong understanding.
Now we've got a dependency on both EM and Celluloid. Yay.