Are Flawed Languages Creating Bad Software? (techcrunch.com)

"Most software, even critical system software, is insecure Swiss cheese held together with duct tape, bubble wrap, and bobby pins..." writes TechCrunch. An anonymous reader quotes their article: Everything is terrible because the fundamental tools we use are, still, so flawed that when used they inevitably craft terrible things... Almost all software has been bug-ridden and insecure for so long that we have grown to think that this is the natural state of code. This learned helplessness is not correct. Everything does not have to be terrible...

Vast experience has shown us that it is unrealistic to expect programmers to write secure code in memory-unsafe languages...as an industry, let's at least set a trajectory. Let's move towards writing system code in better languages, first of all -- this should improve security and speed. Let's move towards formal specifications and verification of mission-critical code.
Their article calls for LangSec testing, and applauds the use of languages like Go and Rust over memory-unsafe languages like C. "Itâ(TM)s not just systemd, not just Linux, not just software; the whole industry is at fault."

Comments

A poor craftsman blames his tools.

[Anonymous Coward]

It's not the language, it's the programmers and the rush to produce easy code. Speed and simplicity trumps security and efficient coding these days.

Re:A poor craftsman blames his tools.

[Anonymous Coward]

A good craftsman doesn't blame his tools because a good craftsman doesn't use poor tools.

Re:A poor craftsman blames his tools.

[allo]

A good craftsman chooses good tools.

Of course you can create excellent work with very bad tools.
But the first a good craftman does is to search for the right tools. He checks his budget, then starts to search for the right tools and if they are too expensive, he searches for replacements, which are for him (but not for everyone) similiar useful. If he cannot find a tool he needs for good work, he's honest about it and tells his client before starting to work.

Re: A poor craftsman blames his tools.

[Anonymous Coward]

Give me a crappy handsaw and nothing else and expect me to do perfectly mitered crown molding in no time at all? You get shit.

Same tools with more time? Now we can talk about my skills I.e. can I do it properly with just that handsaw but time to make it right?

On the other hand, give me a nice table saw where I can simply set the saw to miter correctly and I can do these crown moldings perfectly in no time at all.

The moral of the story? Yes in scenario 2 the poor craftsman will still blame the tools but a good one will also do it because he does know how to do it but he also knows that the table saw exists.

Re:A poor craftsman blames his tools.

[Anonymous Brave Guy]

A good craftsman doesn't insist that his tools necessarily do the job for him either.

As programmers, automation is the essence of what we do. Any programmer who isn't insisting on their tools doing work so they don't have to do it themselves isn't making very good use of those tools. That is as true for safety, security and defensive programming as for any other aspect.

Re:A poor craftsman blames his tools.

[Anonymous Brave Guy]

What happened with "We rely on the developer to do a good job?"

We tried that experiment, and it failed when roughly 0% of professional programmers turned out to be more reliable than an automated tool designed specifically to prevent certain types of programming error.

Can we just stop finding excuses to deliver crap quality code?

You're implying a false dichotomy. There are plenty of programmers who produce generally decent code but still make mistakes that better tools will catch before they go into production.

Re:A poor craftsman blames his tools.

[Bengie]

against what the senior people advice

Most senior people are equally incompetent. Senior programmers tend to be pattern-anti-pattern cargo-cult programmers. They seem competent to those who are incompetent themselves. They also like to use buzzwords. "I'm going to use a no-sql database to increase the scaling performance" only to reinvent a relational database on top of a no-sql database and get strange data oddities because they didn't realize that "transactions" in their chosen no-sql DB does not mean the same thing as "transactions" in a proper relational database. Then after fixing the transnational issues, the no-sql DB is now slower because synchronization is more expensive in no-sql.

Knowledge in an of itself is useless. The Google datacenter is more knowledgeable than any human, yet it is stupid, about as smart as an insect. Wisdom is what one gains from making mistakes, talent allows you to skip making mistakes in the first place. A wise person can correctly recreate what they have already done in the past, talented person can correctly create something entirely new.

Re:A poor craftsman blames his tools.

[Anonymous Brave Guy]

I think Bjarne Stroustrup, among others, could reasonably challenge your claim.

But as I said, the reasons for C's continued popularity aren't technical. There's a huge ecosystem around it, including using it as programming's lingua franca. For that to change, either we need an industry heavyweight with enough resources to create not just a better language but the tools and libraries and developer ecosystem around it, or we need some sort of external pressure to drive the change, so that enough professional developers start caring enough about improving quality to switch to new languages and tools despite C's established presence.

Re:A poor craftsman blames his tools.

[Spazmania]

Java is a memory safe language. Great error handling too. The language does so many things right, it's scary.

Intermediate result: java attracts incompetent programmers who find that their java code doesn't outright crash the way their C code tends to. Because their code works, more or less, it becomes hard for a non-programmer manager to tell the difference between a java guru and an incompetent boob.

Final result: most java code is utter crap riddled with errors compared to typical C code.

Re:Software isn't enough, hardware must change

[gtall]

And then Intel happened, and we've suffered ever since.