All the Safeties: Safety in C++ - Sean Parent

All the Safeties: Safety in C++ - Sean Parent - CppNow 2023

Рет қаралды 16,026

Күн бұрын

www.cppnow.org
/ cppnow
---
All the Safeties: Safety in C++ - Sean Parent - CppNow 2023
Slides: github.com/boostcon
---
Safety is a hot topic. What do we mean by "safety"? How does it relate to correctness? What about security? This talk proposes a taxonomy of general computer science terminology with specifics about how it applies to C++ and how this better understanding can be used to write Better Code.
---
Sean Parent
Sean Parent is a senior principal scientist and software architect managing Adobe's Software Technology Lab. Sean first joined Adobe in 1993 working on Photoshop and is one of the creators of Photoshop Mobile, Lightroom Mobile, and Lightroom Web. In 2009 Sean spent a year at Google working on Chrome OS before returning to Adobe. From 1988 through 1993 Sean worked at Apple, where he was part of the system software team that developed the technologies allowing Apple’s successful transition to PowerPC.
---
Video Sponsors: think-cell and Bloomberg Engineering
Audience Audio Sponsors: Innoplex and Maryland Research Institute
---
Videos Filmed & Edited By Bash Films: bashfilms.com/
KZfaq Channel Managed & Optimized By Digital Medium Ltd: events.digital-medium.co.uk
---
CppNow 2024
www.cppnow.org
/ cppnow
---
#boost #cpp #cppprogramming

Пікірлер: 35

@kuhluhOG 6 ай бұрын

33:30 I actually looked that up, but no, Rust as a language does not (currently) have a specification. Some people think that "The Rust Reference" is a specification, but it's explicitly not. But a few months back an RFC got accepted to actually create a language specification.

@Yupppi 8 ай бұрын

The self-driving car was a fascinating example of safety and in my opinion demonstrates the difficulty of defining safety exclusively. A self-driving car that can't drive off the road is not the safest car. In an unexpected traffic event the safest option can very well be driving off the road, even crashing off the road. I don't know how that would directly apply to software design though, but it's a good one for making you think how sometimes the context is different enough that the perspective changes in what's safe. Or like how some physical safeties rely on the fact that something breaks and gives up for not being up for the task. Like you don't want your fuse to be replaced by a thick nail, even though it allows you to use your device without cutting electricity. And by definition it is a good and a safe nail because it can stand the stresses applied to it. You recognize safety when you're missing it and something goes wrong, but you don't recognize safety when nothing goes wrong. You might assume safety, but that's not accurate. Like you think your house is adequately safe until you get robbed and realize that in fact the safeties in our houses are really poor if someone really wants to get in and isn't too afraid of the consequences. On the other hand you might be perfectly safe in an amusement park ride, but have a strong sense of lack of safety. These talks by Sean Parent always make everyone fall so quiet until after. It's like you can hear a pin drop, everyone is so focused on what he has to say. Without exception it seems to be important and thought provoking.

@mahboudz Жыл бұрын

Great talk Sean!!

@Roibarkan Жыл бұрын

50:58 Stepanov’s lecture (I believe): kzfaq.info/get/bejne/j9KGiN173LTDiJc.html

@binary132 4 ай бұрын

1:14:00ish - thinking in terms of preconditions - those requirements need to be machine-enforceable. That might be more painful to use, but think of Concepts - these kinds of tools ought to help, not hinder us.

@kuhluhOG 6 ай бұрын

It's amazing that the first 20 minutes are a repetition of a lecture I had last week. Like, how did I manage to do this from a timing perspective?

@mahboudz Жыл бұрын

Was the audience microphoned too? I'm curious why there's so much background noise, when the speaker seems to be nicely mic'ed.

@noxabellus 11 ай бұрын

On Chandler's video someone commented about not being able to hear the audience questions, and he replied saying that they had mic'd up the audience in some way they thought would capture questions

@mina86 11 ай бұрын

Muahahaha. Why it doesn’t surprise me that Adobe employee calls GCC non-commercially-friendly.

@JakeHambyZ80 8 ай бұрын

It depends on what you're trying to do. RMS has always been hostile to attempts to modularize GCC to make it more embeddable into commercial IDEs, like Clang/LLVM and Xcode, or at least that's what I've heard. Then there's the GPLv3 issue, a license that some companies and groups (Apple, FreeBSD) refuse to use in the core system. That's why Apple stopped at GCC 4.2.1 and an old version of bash. Those were the last GPLv2-licensed versions. Most companies that use open-source projects want to have their changes upstreamed for ease of maintenance, but they hate to be forced to do anything, as GPL does.

@JakeHambyZ80 8 ай бұрын

FWIW, the GNAT Ada compiler is a front-end for GCC that's commercially-supported and is GPLv3 now, but that project started in the 1990s, and there wasn't any open-source alternative the authors could've used instead.

@GeorgeTsiros 11 ай бұрын

17:55 VirtualAlloc says hi! :D

@tomcampbell5860 11 ай бұрын

Haven't all these problems been solved by the adoption of ada/spark in industry? Ada seems to be a suitable answer to every potential safety-related issue thanks to provability and its other compiler/toolchain features.

@karlklosschen4544 10 ай бұрын

As far I can judge Ada/SPARK isn't well suited for applications which require dynamic memory management. Yet, Ada/SPARK is probably the best language to specify, implement and verify correct software.

@IllumTheMessage Жыл бұрын

We can have 150 finds, then AI can help us pick the right one. (As I would pick the wrong one).

@AndrewCodeDev 11 ай бұрын

We can also have 150 find-finders. Then we can build 150 LLM's that each tell you what find-finder to use.

@Dazza_Doo 18 күн бұрын

Every product deals with user information because that is a second form of rarevenue that make it a companies want to sell. A robotic vacuum cleaner now transmits its images to a server that is not the consumer. The washing machine now send your data to the manufacturer that they sell to third parties and it's all in the user licence agreement. The language is not the problem. Buy defaults, Smart tvs opt you in uploading your user data to the manufacturer. Every smart phone record your text envoice and send it to whoever you have your smartphone with. Your modern car keeps all your text messages, And who knows what else in they cannot be deleted. The boogie man is to blame the programmer, Select let's see how safe we can keep getting the languages.

@fdwr Жыл бұрын

48:45 "There's no real downside [to using std algorithms vs raw loops]" - the big downsides remains readability and debbugability. I love std::accumulate and a few others, but it becomes incredibly gnarly stuffing lambda's inside algorithms inside algorithms. With a simple loop, one can easily follow the flow and press F7 through each step.

@higgins007 Жыл бұрын

I feel the same about most of "modern c++!" :p

@alexb5594 Жыл бұрын

auto my_array = std::array{0,1,2,3,4,5}; bool const all_under_10 = std::ranges::all_of(my_array, [](auto v){return v < 10;}); Sure maybe you have a point about debug-ability. but when in the world do you need to debug this? Why would you have to debug an algorithm? If you do need to, then maybe you shouldn't be using an algorithm. Readability though? You're beyond wrong, try writing the snippit I wrote in 10 seconds with a for loop, and make sure you don't screw up the condition, that's an easy to make mistake. Algorithms do EXACTLY what their name says, declarative programming is immensely superior in readability than for loops. Furthermore, if you're not at least using ranged for loops, then you're the type of programmer that will eventually kill someone. Raw for loops are harmful.

@broken_abi6973 11 ай бұрын

Unfortunately, debuggers don't support us a lot with navigating C++. It should be possible to tell the compiler to stop at the "N" iteration starting from begin() in a std algorithm.

@GeorgeTsiros 11 ай бұрын

@@alexb5594 "Raw for loops are harmful." pray you never see what the compiled code looks like. You may not like it, but raw for loops are what peak performance looks like. specifically, for(;;) loops.

@mynameisjeff9124 11 ай бұрын

@@GeorgeTsiroswell obviously they get compiled to raw for loops. It’s considered harmful, because of humans write bad code from time to time and stl algos try to remove unnecessary points of failure like bounds checking in raw for loops

@mytech6779 9 ай бұрын

AI verification when AI its self is unverifiable?

@CuriousCauliflowerX Жыл бұрын

C++ programmers in 2004: "you should move on from C to C++, C++ is so much safer, reduces mistakes and is just as performant" C++ programmers in 2023: "what even is safety? let me split hairs for half an hour about safety definitons, moving to a safer and just as performant language is not the solution"

@danielsan901998 11 ай бұрын

The knowledge of programing language design continue to advance, and the perceptions about safety have changed, a talk about safety is just a part of this reevaluation, calling this splitting hairs is just showing how ignorant you are, but if you don't want to learn about safety nobody is forcing you to watch this talk.

@williamchamberlain2263 Жыл бұрын

1500 views, 98 likes; cpp programmers really are introverted

@robertbruce7686 9 ай бұрын

😂😂😂😂

@GeorgeTsiros 11 ай бұрын

no such thing as "memory safe language". No, not even GW-BASIC. The _moment_ you make an API call to the OS, all your "memory safety" goes straight out the window. Why does the NSA say it, are they stupid? No idea, they could be, they could be not. _That_ piece of advice, though, is just bad. Besides, "memory safe language" means _nothing_ when your compiler is not proven correct: as far as I know there is only one formally verified compiler, compcert for a _subset_ of c99.

@binary132 4 ай бұрын

I’ve often thought about how ironic it is that there are all these formal verification languages implemented in totally unverified platforms. Inductively, it seems nonsensical. How can you prove that something is sound if the tool you’re using to do it isn’t sound?

@paulfloyd9258 11 ай бұрын

kzfaq.info/get/bejne/g7VdpMiZz8mUZKc.html Divide by zero most commonly gives +/-Inf depending on the signs of the dividend and devisor. Only if the dividend is zero will you get NaN. If floating point exceptions are enabled you will get a SIGFPE.