Go isn’t secure?!? feat. Low Level Learning

Go isn’t secure?!? feat. Low Level Learning | 053

Рет қаралды 36,096

Күн бұрын

In today's episode, we welcome Low Level Learning, a fellow programmer and content creator. With over 500k subscribers and his own course where he teaches low level programming topics, he came on the podcast to talk about what he knows most: C, low level concepts, AI, as well as share some of his own developer experiences and preferences that he garnered over the years.
Learn back-end development - ⁠boot.dev⁠
Listen on your favorite podcast player: ⁠www.backendbanter.fm⁠
Low Level Learning’s Twitter/X: ⁠ / lowleveltweets⁠
Low Level Learning's KZfaq: ⁠‪@LowLevelLearning‬
Low Level Learning's Twitch: ⁠ / lowlevellearning⁠
Low Level Academy: ⁠lowlevel.academy/⁠
Timestmaps:
00:00 Introduction
00:47 Who is Low Level Learning?
01:34 C is a High Level Language
02:47 Is C lower level than Rust or Zig?
04:33 Front-end vs Back-end, which is harder?
06:34 The Boot.dev stack
07:11 The Low Level Academy stack
07:59 Low Level Academy
09:56 Project-based learning
12:18 sqlc
14:44 How do you debug C?
17:26 Fuzzing Harness vs Unit Testing
22:28 Favorite Feature of C
23:45 If you could change one thing in C, what would it be?
26:53 Where do C programmers work?
29:16 The White House and Garbage Collectors
31:19 What is a side-channel attack?
33:56 Power side-channel attack
35:41 Side-channel attack on boot.dev
37:08 What tooling does Low Level Learning use to write C?
43:59 How do you deal with the lack of a package manager?
48:12 Opinion on statically compiled and dynamic libraries
50:36 Where to find Low Level Learning

Пікірлер: 90

@LowLevelLearning Ай бұрын

Yo thanks for having me on Lane! Always a blast

@Wo0dY101 Ай бұрын

This was super informative, will be checking out your channel! I really want to move to lower level work, find it more interesting and engaging.

@pookiepats Ай бұрын

@@Wo0dY101you’re not wrong brother-I can attest to this. My advice-learn OCAML, there’s a surprising amount of demand and also very interesting projects (not to mention best in class total comp); mostly due to its compiler and how useful and reliable it has been for writing DSL’s in the consulting space. My OCAML pitch tagline: “You’ll never be bored or broke.”

@backendbanterfm Ай бұрын

Was a pleasure having you on our pod!

@backendbanterfm Ай бұрын

An absolute delight friend

@The_Nova_Glow Ай бұрын

Brooooo, when you said bloodshed I had a huge nostalgic flashback.

@skl9942 Ай бұрын

Oh this will be golden! thank you so much for this!

@k98killer Ай бұрын

My favorite Micro$oft product ever is the wired ergonomic keyboard. It takes a few hours to adjust and recover to 80% of your previous speed on a non-ergonomic keyboard, but the reduction in repetitive strain injury likelihood is disproportionate to the relatively minor reduction in speed. The main sticking point is learning not to cross your hands at all, e.g. don't hit T with right index or Y with left index.

@thisisreallyme3130 Ай бұрын

Two of my favorite YTers. TY both for being informative and entertaining, and then again for putting information first.

@ShootingUtah Ай бұрын

I'm a SQL enioyer, ORMs are another language to learn almost for every ORM when you can learn SQL basically once and it's mostly valid for a bunch of different databases.

@gJonii Ай бұрын

I thought about this recently and I think query builder is the proper abstraction level for sql. SQL with type checking, autocomplete and other compile time niceties, when you're writing presumably in some other language. Theoretically it's a tooling issue, but say I write Python, I think it would still make more sense to write query in idiomatic python that compiles into the query, rather than have some tool that tries read both python and sql to figure out where to insert sql type checking, validation against schema etc. Instead, having lightweight query builder with fairly simple 1:1 correspondence to SQL would get the best of both worlds.

@nandomax3 Ай бұрын

Learning the low level stuff, even if its just learning the theory, helped me a lot as an engineer. Sometimes you dont need to know how its done, but understanding whats going on opens your mind to new opportunities

@caseyknolla8419 Ай бұрын

Some great a-ha moments in there. Been a long time since I developed in C. Hearing about how apt has become C's package manager was mind-opening.

@otmanm4095 Ай бұрын

Podcast is great, guests are great, thx sharing

@hansmundelein8493 13 күн бұрын

My fist KZfaq comment ever, just to tell how betrayed I feel about the clickbait title. The episode was great, and I love Low Level Learning, but I expected to learn something about how secure go is. Did I miss something? Now I have trust issues with Backend Banter....

@creeperlv6668 Ай бұрын

40:44 I was a nano guy, until I found `micro`. ;-) But I still install nano EVERYWHERE, Regular Windows 11, WoA Devices, Linux and my friends' macbooks ;-) Nano is really very handy if you want to edit a single file. But I recommend using micro for project work, it supports plugins, and LSPs, and uses like nano.

@tapwater424 29 күн бұрын

It doesn't take long to learn enough vi to be productive. Just learn it you will thank yourself in the future.

@beatrixexe Ай бұрын

Can you interview Anthony gg , the Golang content creator

@polyscone Ай бұрын

I'm just glad to know there's another Sublime user out there.

@shkhamd 16 күн бұрын

The biggest challenge is porting your projects across platforms.

@KevinLyda Ай бұрын

One way to avoid the issues of threads in C is to use select/poll based servers. I've written a number of highly performant apps that way. Dunno if it still exists but there was a webserver called Thor that was done that way and generally outperformed most other things.

@Justin-fq8dt 22 күн бұрын

43:24 If that was the case I doubt anybody would even bother using nvim, it'd be too hard to replicate your config across environment without wasting an insane amount of time. I just export the nvim config folder and have it compressed/backed up somewhere so I can transfer it between environments easily. You can also just make it a git repo (default starter configs like AstroNvim come as repos and usually encourage you to host your own for your configuration) Still no judgement though, I don't know why people make such a big deal about it anyway. I use nvim mainly and still wind up using vscode sometimes (ex: pairing, code sharing extension)

@shubhamg9495 Ай бұрын

I was waiting for you two to talk about the insides of go and whether it is secure or has vulnerabilities or not but unfortunately it ain't in this vid.

@ryanwilliams5499 Ай бұрын

Total wasn't waiting for this 6 months ago...doing great everything is great and fine haha...hahaha...hahahaha

@nandomax3 Ай бұрын

Man! I'm a java developer with 2 years of fullstack experience with react. And i also tought Spring did so much stuff magically. The day I learned Golang I created from the ground a http server to serve html files and I felt like I really did understand how the internet works. Listeningg to a port, parsing the header, finding a file in you directory based on the input you received. It was amazing

@ustav_o Ай бұрын

thats basically backend stuff

@bogoid Ай бұрын

bro you can do that with any popular language is not that golang is being special here

@racapella Ай бұрын

@@bogoid hes not saying its golang only hes saying since you dont need libraries you get to actually see how things work under the hood

@k7iq 14 күн бұрын

This is great !

@rusmaakatupal4723 26 күн бұрын

Relational database to models was fun but models to relational database is just on another level of comfort.

@ichigosama007 29 күн бұрын

for a second i thought both were the same person talking

@codeman99-dev 20 күн бұрын

40:34 WOO! Go GNU nano! I used nano professionally for at *least* six years. As long as you don't need LSP, it really is fantastic. Way more features in nano than most people give it time of day for. At the same time, the configuration is just *one* file. ONE CONFIG FILE! ONE!

@samhughes1747 Ай бұрын

39:40, What!? No way! Bloodshed was the IDE I used when I started out, too! I've never heard another soul reference it before!

@Rhonselak Ай бұрын

Had a course taught by the creator of the ChipWhisperer and did a double take when I heard it get mentioned!

@peekknuf Ай бұрын

Goated

@microburn Ай бұрын

Guys you forgot to start your KZfaq Chapters at 00.00 - that means you won’t get chapters parsed out of your description!! Just add to the beginning of timestamp list: 00:00 introduction

@backendbanterfm Ай бұрын

Thank you!

@microburn Ай бұрын

You went through the effort to timestamp. It was sad to not see it in the client. Just doing my duty. 🫡

@sagarsubedi Ай бұрын

What he said at 42:13 is exactly what I am going through. I bought a Moonlander too but I can only do average of 50 wpm, which is much slower than my 80-100 wpm. Because of this I cannot use it to do my work, but then I need to use it enough so I get to 80 wpm at least. The paradox is very apparent.

@BhargavaMan Ай бұрын

I got my moonlander last month, started at 10wpm since it's my first split keyboard lol. But I'm back up to 90ish now, pretty close to my 110 on regular keyboards. Monkeytype and the game they bundled help a ton!

@tacticalNuclearPenguin_ Ай бұрын

I learned so much from you guys, great talk!

@backendbanterfm Ай бұрын

Awesome! Thank you!

@erictrinque6513 Ай бұрын

bout time you had your brother on... the hair gives it away

@Vergillo 12 күн бұрын

28:55 listening to stories from my friend that works in automotive embedded C/C++ of terrible code and hacks that get approved in there. And then listening to LLL talking about peoples lives being on the line makes me wish Rust and Zig would get adopted faster

@wumi2419 Ай бұрын

42:30 Aren't split keyboards basically test of blind typing? It's the same layout (or you can configure it to be the same layout), but your hands aren't close together. Granted, it becomes different once you begin using layers and other modifiers, and you can configure the layout until no one else but you can type on that thing, but defaults are pretty sane.

@ninilab Ай бұрын

could someone explain at 17:50 in detail how harnessing of specific function works?

@ninilab Ай бұрын

Ok, asked chatgpt and got an explanation. Prompt: a person explains a trick to harness: - compile to intermediate dot o elf file that exposes the symbol of - write a simple function, that puts the input of standard in into that function how exactly to do that?

@TurtleKwitty Ай бұрын

@@ninilab This is exactly why using things like gcc is good; if you use the lower level tooling you already know the code gets made into an o file then you put multiple of those together and you've got a program. In that view doing the harnessing thing is literally just writing a tiny program that calls the function and linking with that o file, it's the exact same as any other code

@kou6244 Ай бұрын

I love GO with raw SQL

@nested9301 Ай бұрын

Is that your brother?

@NickKeighley 19 күн бұрын

What does "ft." mean?

@robotron1236 26 күн бұрын

I think people only say that because hackers kinda like it and it’s starting to replace Python as the LOC for tooling and shells.

@owlmostdead9492 Ай бұрын

20 wpm on qwerty with the moonlander? I feel like that's impossible if you know how to touch type, when I first got mine, I basically was instantly at ~40 wpm only because I had bad touch typing habits. Now I'm comfortably within ~80-90 wpm which is identical to my speed on a normal keyboard, it took 3-4 days maybe.

@coolbugfacts1234 16 күн бұрын

It took me like a month to get used to typing on an ergodox, I would do things like hit X instead of Z because I was used to staggered layouts.

@owlmostdead9492 16 күн бұрын

@@coolbugfacts1234 I can relate but that usually won't drag you down to ~20wpm. When I tried colemak-DH for the first time I was getting ~12wpm.

@alexpyattaev Ай бұрын

Static linking your apps would result in same code loaded many times into RAM, forget cache hits across apps after that...

@_garicas Ай бұрын

Could you explain a bit?

@alexpyattaev Ай бұрын

@@_garicas if your cpu was busy running e.g. firefox, and it called some common function like malloc, that malloc function's code will be cached in the cpu. Now if core is tasked with running another program (e.g. your shell), it is likely to be able to reuse the malloc instructions. However, this only works if both Firefox and shell refer to the exact same malloc implementation, loaded from the very same shared library on disk. Even if both programs use identical malloc impl, but load it from different files on disk, the OS is not smart enough to figure out that only one instance needs to be loaded, and will load both into the memory. This means that each program will have to pull its own version into cache whenever context switching happens, which is not great for performance. On top of that, all your software will consume more memory overall. The difference gets mighty noticeable when you have a whole bunch of apps loading some bulky GUI library like GTK or QT, which will increase memory use of every app by some 10-15 MB, and totally kill any chance of that UI code sitting in the caches.

@_garicas 29 күн бұрын

@@alexpyattaev Oh I see now, that's interesting, I've never thought about shared libraries this way "inter-process". Thanks for the detailed explanation!

@alexpyattaev 29 күн бұрын

@@_garicas you are welcome!

@k98killer Ай бұрын

I only ever use Nano by accident, and it leaves me feeling like I need to shower.

@maxoumimaro Ай бұрын

Sounds a lot like low level learning has never used cmake xD Like holy shit man don t write makefile except if you have a very specific need for it ...

@mbe2916 Ай бұрын

C is more low-level than Rust. Rust only allows its memory model, and it compiles down to LLVM, which is a great tool but since its a abstraction above machine code that c doenst have. The second point is the memory model of rust is predefined by rust, and it's the reason why it's in it current state won't become part of the kernel(yes there already drivers but in userland) The points you raised about hidden allocations are compiler-specific and can be controlled by using flags. C started as a programming language to build an OS. As such, it's possible to build anything with it. Regarding questions about security, safety, and memory issues, Rust would score higher, but not on being more low-level.

@twenty-fifth420 Ай бұрын

So a few things. Isnt LLVM an abstraction over machine code like GCC because it is a C Compiler? This argument doesn’t make any sense. And isnt Rust part of the Unix Kernel? I mean, I don’t know what this has to do with that. I don’t essentializing the memory model to say why it can’t be in a kernel makes sense. Also, C as a programming language was designed to write a OS, yes, but this was in the 70s. Our computing models are now much different. And I think C++ sort of pairs with that too. I don’t think what you mean with ‘it can be used to build anything’ is valid. Everyone says that about every language. Even in Systems, you could probably build an OS with Python if you are a masochist if you use the C FFI. I don’t think your comment is valid, alot of half explainations and opinion. You are going to have to be a bit more specific. Also, assembly is the abstraction above binary machine code, but I think C has only grown to be a good systems langusgd because there is likely a compiler somewhere for C for any niche architecture. Or now not so niche like ARM. RISC V has a compiler for C I believe. My point with that is that assuming machine architectures for chipsets are to diversify, then sure, you should probably use C. But not for the reasons you said.

@mbe2916 Ай бұрын

@@twenty-fifth420 Llvm is a abstraction layer, as such its not as low level as machine code. For the rest of your points, please read my comment again because it already answers your questions

@aniketbisht2823 Ай бұрын

C++ does both. You can go as "low" as C, because C is a subset of C++, and go as high level as Rust and beyond. For the high level side, I think, C++ has better features than Rust like template, constexpr, classes, function and operator overloading (great for making DSLs), user-defined literals... etc. Currently C++ is lacking reflection which would be added in C++26 along with many other niceties. I would argue using C++ you can generate better assembly (low level code) than C by using it's high level features to "scale" a low level pattern for many types and sizes, whereas in C you would have to hand-write it yourself for every other situation or use macro(poor man's template) which is quite limited.

@mbe2916 Ай бұрын

@@aniketbisht2823 this is not argument about what the lowest level programming language or the best. It's a reaction on the argument presented in the video

@anonymousalexander6005 Ай бұрын

LLVM is perfectly fine to use, it’s no different than relying on Intel Assembler or another abstraction, C is as abstracted this day and age sorry to burst your bubble, unless you’re designing microcode. Rust’s memory model is fine for most uses, and indeed the most common, i.e. single writer multiple readers, but it’s incredibly inconvenient for applications that don’t adhere to this and DSL’s will better excel. Allocations are uncontrollable behavior because for most systems that use things like overcommit, they are inherently uncontrollable, to a certain extent. Nightly APIs offers more control, but only in so far as the system and allocator will behave in a predictable manner.

@jogurtnaturalny Ай бұрын

First!

@theshinyplayer2373 11 күн бұрын

6:12 You can't do a SQL query to check user login today, what are you talking about?!? That's way too advanced today. Today you need to use a platform service that can hande auth for you, you can't do that complicated stuff yourself, are you crazy?!

@Swifter101 Ай бұрын

I understand not having time to learn vim motions but configuring neovim then keeping the config with git or something else is not difficult i am noob when it comes programming compared to these guys but neovim configuration is not that hard.

@Heater-v1.0.0 Ай бұрын

They missed a little point. Rust will let you reach down to the same low level as C, fiddling with I/O ports, bits and bytes with small fast binaries on tiny micro-controllers. Rust with its type system, structs, methods, traits, standard library and crates eco system it reaches a level of abstraction comparable to C++, Javascript, Python etc. So yes Rust is low level like C, it's also as high level as many other languages in common use.

@Critiquetech 28 күн бұрын

Not the same level. Rust is still very immature for real low level , any hardware support. Years behind. I don't know why Rust programmers has this obsession to replace every other language on earth. Maybe terms like: "Arcane", "old-fashioned", "Sure we can do better in Rust", "to help us write correct code", and etc.. Which are found in their manual pages can explain that.

@Heater-v1.0.0 28 күн бұрын

@@Critiquetech Please tell us how, compared to C, Rust is "immature for real low level"? I can use Rust on microcontrollers without any OS support, accessing IO registers, juggling interrupts, dipping down to asm when required, etc, etc. There are very many people doing that. One can write operating systems from the ground up in Rust just like C. And the resulting binaries are of similar size to those of C and match it for performance. Why not take advantage of the language luxuries and error checking of Rust? There is a reason people building safety critical embedded systems are seriously looking at Rust. In my experience serious Rust enthusiasts are not campaigning to replace every other language on Earth. They are not so dumb as to think that is going to happen. I guess you have a lot to learn about Rust. Please do take the time, it's fascinating and fun as well as being very helpful.

@Critiquetech 27 күн бұрын

@@Heater-v1.0.0 C'mom I think I don't need to explain that. If you think the opposite, fine. Just continue to use it in the so many micro and tiny microcontrollers its support. I know Rust, and I know it was not thought as a C replacement, but I'm not a fan, moreover I'm not a big fan of anything. If it's good and useful, I use. If it's not, I just don't use it. But fyi Zig is near (not there yet too) to a C replacement than Rust. There are some freedom in C that I (and millions of others) like (and need) which is only achievable in Rust with the unsafe mode, pointers being just the tip of the Iceberg, you probably are aware of that, and to use unsafe mode is better to stay in C. Whenever Rust fan base complains "Rust can do it too, at the same level, and it' more safe, why not use it?" I feel like here we go again, oh my, just use it and don't try to push. If it's good enough people will come naturally, not by force. And no, the level is still a bit below for low level. Not there yet.

@Heater-v1.0.0 27 күн бұрын

@@Critiquetech Hmm... I did not comment here to push Rust by force. I came here to correct what I know to be a misrepresentation of Rust. Miss representation you then doubled down on by saying "Not the same level. Rust is still very immature for real low level ". You are right, Rust was not originally considered as a C replacement in its early days. They considered garbage collection and green threads for example. But that has not been the case for many years now. Parity with C became a priority. That is why Rust has no garbage collector and green threads were replaced with async. Another misconception is that because Rust has "unsafe" blocks it has no advantage over C, which is all unsafe. That is not so. Let's make a deal, I will try not to push Rust if I find myself doing so, in exchange you stop putting it down with misinformation. OK? By the way, I have used C for decades, I still love it for its simplicity, for the fact that one man can write a compiler for it in a reasonable amount of time. That is not going to change any time soon.

@coolbugfacts1234 16 күн бұрын

@@Critiquetech There are two types of people: those who know it is impossible to write safe C/C++, and the delusional. You should be very careful when reviewing a code change from someone with delusions.

@alexandersemionov5790 Ай бұрын

For lowcode/nocode people python is probably low level

@user-hk3ej4hk7m Ай бұрын

I do embedded development on small devices running linux buildroot and microcontrollers. C is just a means to an end, if I had to choose something I'd go for python, nim or c++. The lack of templates makes making anything with var args a pain, typedef enum means absolutely nothing, and void* is way too easy. Too many footguns and no way to define guarantees. Idk this Stockholm syndrome thing of revering c began, but it seems to come from people that use it in full blown OS' where there's a vast selection of debugging tools.