Slashdot Mirror


New NSA-Funded Code Rolls All Programming Languages Into One

An anonymous reader writes "What's your favorite programming language? Is it CSS? Is it JavaScript? Is it PHP, HTML5, or something else? Why choose? A new programming language developed by researchers at Carnegie Mellon University is all of those and more — one of the world's first "polyglot" programming languages. Sound cool? It is, except its development is partially funded by the National Security Agency, so let's look at it with a skeptical eye. It's called Wyvern — named after a mythical dragon-like thing that only has two legs instead of four — and it's supposed to help programmers design apps and websites without having to rely on a whole bunch of different stylesheets and different amalgamations spread across different files.

45 of 306 comments (clear)

  1. Wyvern = Wyrm by Anonymous Coward · · Score: 3, Interesting

    Why? What's the worst that could happen? What's the best?

    Why is the NSA interested in something like that directly? What is the potential for abuse?

    Is it to make code analysis that much more centralized and (supposedly) simple?

    Why didn't this come up with itself before now?

    1. Re:Wyvern = Wyrm by ObsessiveMathsFreak · · Score: 4, Interesting

      The standard NSA tatctic for introducing security holes into a system is to obfuscate things so that holes are hard to spot and find. SELinux is probably such a system, and this polglot language -- which effectviely makes debugging impossible -- is likely another.

      --
      May the Maths Be with you!
    2. Re:Wyvern = Wyrm by Bite+The+Pillow · · Score: 5, Insightful

      Why?

      To write applications in one language, instead of HTML, CSS, JavaScript, SQL, and something else. Not including multiple levels of configuration files (website and web server at least).

      What's the worst that could happen?

      The NSA could insert backdoors which, unless they were incomprehensible crypto, would be easily found by both white and black hat investigators. Also, Carnegie Mellon University, which has a pile of research announcements every year, has its entire research department under suspicion of colluding with an oppressive government agency and spends decades regaining international status as someone you can do anything other than make the punchline of a joke.

      CMU losing status is, to CMU, absolutely an intolerable option. I'm not saying it won't just because of the potential impact, but you asked what is the worst that could happen. Backdoors, and a respected university bursts into flames and is disregarded for decades internationally. That's bad.

      What's the best?

      Fewer bugs.

      Why is the NSA interested in something like that directly?

      Because despite recent bad press, they are interested in security. If we can write stuff with fewer bugs, we are more secure. Maybe there are still plenty of bugs in the hardware/OS that they know about, but fewer bugs in the application level, which means the foreigners don't know about them because they don't exist.

      What is the potential for abuse?

      Pretty small. White hats will vet the libraries, black hats will try to penetrate it, and it's no more or less secure than anything else a human has written. But people can make mistakes in fewer languages. And they aren't replacing languages, from the sound of it.

      Is it to make code analysis that much more centralized and (supposedly) simple?

      I suppose you could read the article.

      Why didn't this come up with itself before now?

      Why didn't the airplane come up before it did? Are you insinuating something? Do you know something we don't know? Did someone mod you up for any particular reason, or just because you spewed thoughtless rhetorical questions?

    3. Re:Wyvern = Wyrm by TheMCP · · Score: 2

      It *has* been done before. I worked on it years ago. One of my colleagues came up with it in 1999.

      http://www.waterlanguage.org/

      It was brilliant to work in, but it didn't catch on.

    4. Re: Wyvern = Wyrm by Anonymous Coward · · Score: 2, Interesting

      Not impressed. The OP obviously doesn't understand a thing about programming languages in general, or programming as an activity in particcular. Or he would know that the use of multiple files, and multiple languages, is a means to an end, not a nuisance. Namely to manage complexity, and to use the most appropriate level of abstraction to solve a particular problem. If he'd know he would not claim that wyvern is a polyglot language, but that it is a meta language to create internal DSLs, domain specific languages. So if anything it is a tool to create new languages, as oppose to to eliminate existing ones as by his claim. Poor sod

    5. Re:Wyvern = Wyrm by Anonymous Coward · · Score: 5, Insightful

      backdoors [...] would be easily found by both white and black hat investigators.

      That's about the same as stating it is as simple to find a needle in a haystack as to put one in.

      We already have issues finding normal bugs. We have seen flaws in kernels and encryption libraries that might have well been a typo, yet were in for years.

    6. Re: Wyvern = Wyrm by ObsessiveMathsFreak · · Score: 2, Insightful

      To properly need to debug such a language, you would need to be aware of all of the possible rules, pitfalls, bugs, and race conditions of every language under its hood.

      At a basic level, is your "if else" condition running on it's Java or C++ or C version? Does it catch exceptions? Where is data being handled in memory? Are buffer overruns possible in some of these languages?

      No one human could possibly we simultaneously cognisant of all possible sources of error. Programs in such a language would be a security disaster waiting to happen.

      --
      May the Maths Be with you!
  2. Lack of basic research by Taco+Cowboy · · Score: 5, Insightful

    I arrived at America pretty late - at the 60's - but at least at that time America had several institutions doing all kinds of wonderful basic research

    Bell Labs
    Xerox's famous lab at Palo Alto
    The Skunkworks

    And at that time Darpa funded a lot of basic research as well

    Today, all gone

    Even Darpa's funding are not aiming at basic research - such as what TFA has outlined - what they are doing at Carnegie Mellon is actually an applied research ... taking what has been known and add another layer onto it

    What's happening in America nowadays is very worrying

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:Lack of basic research by 50000BTU_barbecue · · Score: 4, Insightful

      Of course, a lot of research was done by the private labs of corporations back then, like IBM, RCA, etc.. Engineering was a respected profession, you needed real talent to become an engineer or programmer and you could earn a good living that way in the West.

      Then one day some bright psychopath realized it would be cheaper if universities did the research with government money instead.

      Then you get the research done, your future employees come already in debt, and then they work for peanuts paying back their student loans.

      So companies used to pay YOU to do research, now YOU pay to go to university and the companies get to keep the IP!

      And social engineering and manipulation means that people will WILLINGLY do so!

      Brilliant!

      --
      Mostly random stuff.
  3. Wyvern? by lsllll · · Score: 2

    I looked up images of Wyvern on Google images. Don't think it's a good choice. Reminds me of the NSA's overreach over our lives. I think they should have named it Pussy Cat.

    --
    Is that a roll of dimes in your pocket or are you happy to see me?
  4. Shit summary by Anonymous Coward · · Score: 5, Insightful

    CSS and HTML5 are not programming languages. You don't "choose" html5 over, say, php.
    (And don't fucking say HTML5 + CSS3 is turing complete)

    1. Re:Shit summary by Bing+Tsher+E · · Score: 5, Insightful

      I didn't see any programming languages in the list on the summary. Just a bunch of web shit.

    2. Re:Shit summary by binarylarry · · Score: 4, Funny

      Yeah and can you imagine the horrific shit sandwich that would be a combination of CSS, HTML5, PHP and JavaScript?

      666 Mark of the Techno Beast. It's like some shit Ghostbusters 2099 would be tasked with stopping.

      --
      Mod me down, my New Earth Global Warmingist friends!
  5. CSS? by Anonymous Coward · · Score: 5, Funny

    "What's your favorite programming language? Is it CSS?"

    Why yes, I just love writing VoIP systems in CSS.

    1. Re:CSS? by sillybilly · · Score: 2

      Every time I see the wish to create yet another, newer, better way to program a computer, instead of the oldschool assembler, C, Basic and Pascal methods, it keeps reminding me to ask people to let's come up with a better way to represent numbers. As in Roman numerals like MCMLXXXIV truly suck compared to Hindu (called Arabic) 1984 numerals, but we shouldn't leave it at that, there's gotta be something better than that Hindu representation. But the reality is that we'd be like a dog chasing it's tail with a myriad of patentable yet equivalent or even worse ways to represent numbers, and in fact even if equivalent, the cost of getting used to the new was is by itself not worth it, without any tangible benefit. So whoever makes a living on inventing new numeral ways of representation, like those in the computer science business are trying to make a living from inventing run of the mill but no better than what we used to have, patentable languages, they are in the same situation. At least that's my 2 cents. We gotta keep evolving, we gotta keep up with the times, we gotta keep up with change. Oh yeah? How about some French numerals then, instead of Roman or Arabic ones, that are better. Or American numerals. Who can come up with a better way to do it? Huh? Huh?

    2. Re:CSS? by doublebackslash · · Score: 4, Insightful

      I'd like to point out that you can't represent irrational numbers accurately without a new system. Let alone trancendental numbers.

      Also some numbering systems are more convenient. Binary, for example. Not different numerals, but used differently.

      I know, not exactly your point, but don't dismiss languages other than C, Basic, and Pascal.

      --
      md5sum /boot/vmlinuz
      d41d8cd98f00b204e9800998ecf8427e /boot/vmlinuz
  6. Compiler virus by penguinoid · · Score: 4, Interesting

    Wasn't there some discussion on how effective a special, compiler-embedded virus would be? This seems like a good candidate for that.

    --
    Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
  7. You have n programming languages... by Anonymous Coward · · Score: 5, Funny

    You have n programming languages. You think "That's to many, let's invent a programming language that combines all of them!", and then do so. You now have n+1 programming languages...

    1. Re:You have n programming languages... by weilawei · · Score: 2

      Apologies to you, AC, for hijacking your highly upvoted comment.

      We appear to have something rather serious at work here. A registered user (jelIomizer, the second 'L' is actually an 'i' character or some Unicode variant) posted over 28 posts (all MyCleanPC spam) in under 6 minutes on this article--something neither you or I can do. This smacks of a slashcode bug or admin collusion.

      For reference...

      Oh yeah, hello to all the friendly NSA propaganda operatives out there. Go fuck yourself.

    2. Re:You have n programming languages... by BitZtream · · Score: 2
      --
      Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
  8. Ridiculous Summary, Interesting Papers by Anonymous Coward · · Score: 3, Informative

    As you'd expect from CMU, the papers themselves are pretty interesting. Just read the abstracts instead of trying to guess from the summary or vice article, which are both way off the mark.

    http://www.cs.cmu.edu/~aldrich/papers/ecoop14-tsls.pdf
    http://www.cs.cmu.edu/~aldrich/papers/maspeghi13.pdf

  9. why- just why? by sumdumass · · Score: 3, Insightful

    Why in the hell would you need to look at something with a skeptical eye just because money came from a certain source? Is the reputation of carnegie mellon suspect or something? And if so, shouldn't that in and of itself be the reason of suspect?

    The submiter is a shallow person suffering from guilt by association which is never a valid premise. I mean i know skin heads who donate to planned patrenthood specifically because they have all their abortion clinics in areas with high minority populations and keep the minority populations in check. Does that mean we have to look at them wiyh a skeptical eye too? Of course not- or at least npt because a source of their funding has issues most of us find repulsive.

    The merrits of this will rest on its own. There is absolutely no reason to put the integrity of the development into question simply because the NSA gave funding.

    1. Re:why- just why? by Spinalcold · · Score: 4, Insightful

      You should always look at the funding path. It tells you a lot about the quality of research. In the past 60 years funding towards 'think tanks' has gone into making bad science to combat good science research, all in an effort to move political goals. I'm not saying this particular research is bad, however it is good to know some of the funding came from the NSA.

    2. Re:why- just why? by hubie · · Score: 2

      They fund it because they fund all sorts of basic and applied research.

  10. No, it doesn't "roll all languages into one" by Animats · · Score: 5, Informative

    No, it doesn't "roll all languages into one". It just allows embedding of the text of another language, such as HTML, into a Wyvern program. Variables can be substituted. Like this:

    let webpage : HTML = <html><body><h1>Results for {keyword}</h1
    <ul id="results">{to_list_items(query(db,
    SELECT title, snippet FROM products WHERE {keyword} in title))}
    </ul></body></html>

    (except that the last 3 lines above should be indented, because this language uses Python-style block notation.)

    Of course, everybody does that now, but the way they do it, especially in PHP, tends to lead to problems such as SQL injection attacks. The idea here is that Wyvern has modules for the inserted text which understand what kinds of quoting or escaping are required for the embedded language text.

    I just glanced at the paper, but that seems to be the big new feature.

    1. Re:No, it doesn't "roll all languages into one" by Anonymous Coward · · Score: 2, Informative

      It's not just about quoting or escaping. It actually builds an AST for each TSL expression (for example, an HTML expression), so they can tell if the expression is valid and how to combine the Wyvern expression with the TSL expression containing it. It looks like brain-dead string concatenation, which reduces clutter and improves readability, but it gives you all the benefits of using the type system.

  11. skilled international negotiator! by silfen · · Score: 2

    "Wyvern is like a skilled international negotiator who can smoothly switch between languages to get a whole team of people to work together," Aldrich said. "Such a person can be extremely effective and, likewise, I think our new approach can have a big impact on building software systems."

    Yeah, about as skilled and effective as past Israeli-Palestinian negotiators...

  12. CSS? JavaScript? PHP? HTML5? by tommeke100 · · Score: 5, Insightful

    To write better Apps and Websites?
    Are these what the kids call programming languages these days?
    It doesn't sound very serious.

    1. Re: CSS? JavaScript? PHP? HTML5? by Beck_Neard · · Score: 2

      > Are these what the kids call programming languages these days?

      Yup. A lot of 'programmers' don't even know non-web languages exist. I wish I was kidding. And a lot of employers don't know either. The whole thing is just really sad.

      --
      A fool and his hard drive are soon parted.
  13. Programming language? by Anonymous Coward · · Score: 2

    CSS: not a programming language.
    HTML: not a programming language.
    PHP: not a programming language.

    Note: I'm a web developer mostly these days, I write a bucket of each of these. I'm a computer science educated professional and I also write a lot of code in Java and C++. I really like PHP. It is however not a bloody programming language, it's a scripting language.

    1. Re:Programming language? by gweihir · · Score: 2

      Well, PHP is a programming language, just not really a general-purpose one.

      Anyways, web-stuff is a small part of programming, and not really an important one as it is pretty limited.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    2. Re:Programming language? by Capsaicin · · Score: 5, Insightful

      I really like PHP. It is however not a bloody programming language, it's a scripting language.

      I really hate PHP, but what I hate even more is being confronted with this mysterious distinction between "scripting" and "programming" languages.

      A language might be strongly or weakly, dynamically or statically typed. A particular implementation might employ a compiler, a virtual machine or interpreter. These are meaningful distinctions. But what (with the possible exception of a hardware specific control language) does it even mean for a language (as distinct from its implementation) to be a "scripting" language?

      Would PHP cease to be a scripting language if an object code compiler were available for it? Is 'C' a "scripting language" just because it's interpreted? And what about a language which has never actually been implemented, what in the language specification determines unequivocally if that language is 'scripting' or a a 'programming' language?

      --
      Better to be despised for too anxious apprehensions, than ruined by too confident a security. --Edmund Burke
    3. Re:Programming language? by DocHoncho · · Score: 2

      That's a distinction without a difference. All "scripting languages" are programming languages, quibbling over whether the particular domain a language is used in makes it a "real" language or not is fodder for arrogant asses who need to make others seem smaller to boost their own pathetic egos.

      Obviously, different languages have different strengths and weaknesses. You wouldn't write an OS kernel in JavaScript, and you wouldn't write system administration automation in C++. Sneering at the domain of one language or another is just useless posturing.

      --
      Celebrity worship is a poor substitute for Deity worship and costs more to boot.
    4. Re:Programming language? by DocHoncho · · Score: 2

      The distinction is determined solely by the prejudices of whomever is bothering to make it. Scripting is a domain in which a programming language is used, not some basic attribute of it. You could use C to write your system automation tools, but it would be a waste of time when a simple Bash script would get the job done quicker and in a far more concise manner. Likewise, you could write your virtualization software in Ruby but its going to be dog slow, and probably full of weird hacks to make shit work.

      Programming languages are for solving problems, and depending on the problem you may need the higher level of abstraction provided by a so-called scripting language. Others are better served by getting as close to the metal as possible. Not every problem requires getting bogged down in the minute details of memory allocation, hardware IRQs, or chipset specific instructions. It might make it fast as hell, but you could easily get lost in the weeds and never end up solving the real problem at hand.

      --
      Celebrity worship is a poor substitute for Deity worship and costs more to boot.
  14. Which behaviour? by NotInHere · · Score: 4, Interesting

    This program is valid C and, when saved as "test2.java", valid java code. Compilation with the C compiler results in a program that doesn't behave the same way if it were compiled with java:

    //\
    /*
    #include "stdio.h"
    /**///\
    public class test2 {

    //\
    public static
    void main //\
    (String[]a)//\
    /*
    (int argc, char *argv[])//*/
    {
      //\
      System.out.printf("hi, I'm java\n");/*
      printf("hi, I'm C\n");//*/
    }

    //\
    }

  15. LLVM's logo is a wyvern by Henriok · · Score: 3, Insightful

    May I point out that the LLVM logo is a wyvern? http://llvm.org/Logo.html

    --

    - Henrik

    - when the Shadows descend -
  16. if it did, that would eliminate my bugs by raymorris · · Score: 3, Insightful

    It doesn't do what the summary says.

    If it did, that would take care of half of my bugs. Within a 30-minute period, I might well work in PHP, Perl, ActionScript, JavaScript, and some other language. A large portion of my errors are things like using empty() in JavaScript. Especially, ActionScript is almost the same as JavaScript, and a lot of Perl is also valid PHP, so when switching between these it's easy to absent-mindedly tap out a line in the wrong language.

    Once upon a time, I used vim syntax highlighting, which doesn't typically catch using the right syntax, but the wrong function name, but does make missed braces and such obvious. Maybe I should right a vim plugin for "wrong language, dummy." It would look for echo (phph vs print (Perl), etc.

  17. Re:Urgently needed for /. --- An 'un-friend' featu by rmdingler · · Score: 2
    Jelly's comments suffer in quality when his Ritalin prescription is used up only half way through the month.

    There's a comment threshold feature that effectively eliminates your ability to see low rated comments, which these ravings are rendered to with a quickness thanks to a rather decent moderation scheme.

    Caveat: two or three of the smartest things I've ever read on here were, at least at one point, low threshold.

    --
    Happiness in intelligent people is the rarest thing I know.

    Ernest Hemingway

  18. Re:Not programming languages by gweihir · · Score: 2

    Indeed. And JavaScript and PHP are special-purpose languages that are unfit to be user in a general setting. The OP has no clue.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  19. All programming languages? by rossdee · · Score: 2

    Does it do APL ? Forth ? 6502 assembler?

  20. Its really too bad... by Karmashock · · Score: 5, Insightful

    The NSA's reputation has been annihilated. There are good people that work for such organizations. People that could and do benefit our society on a regular basis. Their institution was simply coopted by irresponsible people that sadly destroyed everything. Its a shame.

    --
    I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
  21. FTFY by QilessQi · · Score: 4, Funny

    "Web applications today are written as a poorly-coordinated mishmash of artifacts written in different languages, file formats, and technologies.

    "...and here's another one!"

    1. Re:FTFY by complete+loony · · Score: 2
      --
      09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
  22. Re:NSA: A Source Name we trust! by ron_ivi · · Score: 2

    Sad thing is that not even you know if you're being sarcastic or not.

  23. "bad press", "interested in security" by sacrilicious · · Score: 2

    Because despite recent bad press, they are interested in security.

    Your post makes various other points that sound reasonable to me, but I have to call out the above line from a couple of angles:

    1) using the phrase "bad press" implies a virtuous subject that has been distorted by a reporting industry with a non-virtuous agenda. NOTHING OF THE SORT has happened to poor lil' NSA here... they FUCKED us, straight up, and got caught red-handed.

    2) Whatever the extent to which the NSA is "interested in security", it might as well be the extent to which a wolf is interested in "keeping chickens alive"... yes the wolf wants a food supply, but that doesn't make the wolf a proponent of livestock. The NSA is all about surveillance at this point; their putting on the badge of promoting security is a means to an end. I won't rehash the extensive list of public standards they secretly compromised to that end; it speaks for itself.

    Again, I think much of what you wrote makes sense, but in this particular line you stray notably too far into something approaching neutrality about the NSA. They are bad people with a bad agenda, and they'll fuck YOU the first chance they get.

    --
    - First they ignore you, then they laugh at you, then ???, then profit.