• 1 Post
  • 325 Comments
Joined 3 years ago
cake
Cake day: September 24th, 2023

help-circle
  • That would be good but it’s not a magic solution to this problem. They would just move the exploit to runtime. Yeay you don’t get hacked if you compile and never run your program.

    You can counter that there are some situations where the program is run sandboxed, e.g. if you’re compiling to WASI or microcontroller firmware or whatever. But those are a tiny minority of cases.




  • Yes they do. I don’t think it’s totally unreasonable. Slow compile time is a big productivity drain. But it’s not as bad as people often make out for Rust - in large part because compilation speed has at least doubled since Rust 1.0, but its reputation is still based on the 1.0 compile times.

    And some specific projects do have substantially bad compile times. When your incremental compilation time is 20 seconds where in other languages it’s instant… That’s notably worse.

    But I don’t think it should be a deal breaker. C++ has dealt with similarly bad compile times for decades and people don’t like it but it’s never been enough for most of them to switch to another language.








  • There are definitely some cases where memory safety isn’t especially important:

    • Single player games
    • Apps that don’t process external data (e.g. a simple calculator).
    • Lots of things running on microcontrollers, where the form of input could never possibly cause any security issues. E.g. a motor controller or a basic syringe pump or a (non-smart) washing machine or something.
    • Tests, e.g. I’ve considered writing RISC-V tests in Zig. They’re traditionally written in C or assembly.

    In cases like those, memory unsafety mainly leads to non-security bugs and annoying debugging sessions. But I wouldn’t say it’s as much of a deal breaker compared to e.g. writing a video codec or font renderer or web browser or DNS server or whatever.

    I still think Rust is a better choice than Zig in most cases anyway, even ignoring memory safety. But in these cases it’s at least a defensible choice.





  • No Zig definitely is special. You don’t have to do any extra busy work to call C code - you can pretty much just #include the header and that’s that. It’s similar to calling C from C++.

    In any other languages - including Rust - you have to do some work declaring functions, wrapping them and so on. It’s not hard but it definitely is a non-zero amount of tedious work (especially before AI). There’s absolutely no way you could describe it as “trivial”, unless someone else has already done that work for you.

    But I don’t think it is a significant Zig advantage really. When I’m writing Rust, it’s extremely rare that I want to call any C code that someone else hasn’t already done the tedious wrapping for.



  • GitHub. You’re hosting public stuff so there’s no more risk of your data being sold on GitHub than anywhere else public. GitHub is what recruiters understand and expect.

    I’ll get downvoted by extremists but this is the best option if you want a job and aren’t also an extremist.

    I would consider Codeberg or maybe even Tangled for actual projects you’re working on, but for just showing stuff of there’s no advantage to not using GitHub.




  • That’s a lot of words. I think the reasons are pretty simple:

    1. Some people just don’t care.
    2. The Git CLI is poorly designed e.g. the many different ways to delete something.
    3. Some Git concepts are very poorly named, e.g. the “index”, “ours/theirs”. This adds to the confusion.
    4. There are many Git GUIs but only a very small number of actually decent ones (if you’re wondering: GitX, SourceGit, Git Extensions, and the Git Graph VSCode extension).
    5. There are a lot of idiots out there telling people not to use Git GUIs, when they are clearly the best way to learn how to use Git. Its easy to get into a mess if you can’t see what you’re doing.
    6. Git isn’t actually as simple as us pros would like to think. The underlying model and even the implementation isn’t too complex (I’ve written a Git client form scratch; not too hard apart from the lack of specs/docs). But you can easily get into a state where you’re pulling from a remote and someone else has pushed to the same branch so you need to resolve that (oh btw don’t do what Git tells you to!), and maybe it involves submodules too, and you basically need to fully understand Git’s model and be pretty good at the awful CLI too to resolve it.