Path: ...!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: bart <bc@freeuk.com>
Newsgroups: comp.lang.c
Subject: Re: A Famous Security Bug
Date: Sat, 23 Mar 2024 21:21:58 +0000
Organization: A noiseless patient Spider
Lines: 65
Message-ID: <utnh5m$3sdhk$1@dont-email.me>
References: <bug-20240320191736@ram.dialup.fu-berlin.de>
 <20240320114218.151@kylheku.com>
 <20240321211306.779b21d126e122556c34a346@gmail.moc>
 <utkea9$31sr2$1@dont-email.me> <utktul$35ng8$1@dont-email.me>
 <utm06k$3glqc$1@dont-email.me> <utme8b$3jtip$1@dont-email.me>
 <utn1a0$3ogob$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Sat, 23 Mar 2024 21:21:58 -0000 (UTC)
Injection-Info: dont-email.me; posting-host="3148282f06fd82dfc3c7be70be8dd926";
	logging-data="4077108"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX1/TqBcrhwpMGlyteQEF1uNo"
User-Agent: Mozilla Thunderbird
Cancel-Lock: sha1:Xu5TNo1OXZ/6eAohocVaankPGmE=
Content-Language: en-GB
In-Reply-To: <utn1a0$3ogob$1@dont-email.me>
Bytes: 3666

On 23/03/2024 16:51, David Brown wrote:
> On 23/03/2024 12:26, bart wrote:
>> On 23/03/2024 07:26, James Kuyper wrote:
>>> bart <bc@freeuk.com> writes:
>>>> On 22/03/2024 17:14, James Kuyper wrote:
>>> [...]
>>>>> If you want to tell a system not only what a program must do, but
>>>>> also how it must do it, you need to use a lower-level language than
>>>>> C.
>>>>
>>>> Which one?
>>>
>>> That's up to you. The point is, C is NOT that language.
>>
>> I'm asking which /mainstream/ HLL is lower level than C. So 
>> specifically ruling out assembly.
>>
>> If there is no such choice, then this is the problem: it has to be C 
>> or nothing.
> 
> How much of a problem is it, really?
> 
> My field is probably the place where low level programming is most 
> ubiquitous.  There are plenty of people who use assembly - for good 
> reasons or for bad (or for reasons that some people think are good, 
> other people think are bad).  C is the most common choice.
> 
> Other languages used for small systems embedded programming include C++, 
> Ada, Forth, BASIC, Pascal, Lua, and Micropython.  Forth is the only one 
> that could be argued as lower-level or more "directly translated" than C.

Well, Forth is certainly cruder than C (it's barely a language IMO). But 
I don't remember seeing anything in it resembling a type system that 
corresponds to the 'i8-i64 u8-u64 f32-f64' types typical in current 
hardware. (Imagine trying to create a precisely laid out struct.)

It is just too weird. I think I'd rather take my chances with C.

 > BASIC, ..., Lua, and Micropython.

Hmm, I think my own scripting language is better at low level than any 
of these. It supports those low-level types for a start. And I can do 
stuff like this:

    println peek(0x40'0000, u16):"m"

    fun peek(addr, t=byte) = makeref(addr, t)^

This displays 'MZ', the signature of the (low-)loaded EXE image on Windows

Possibly it is even better than C; is this little program valid (no UB) 
C, even when it is known that the program is low-loaded:

    #include <stdio.h>
    typedef unsigned char byte;

    int main(void) {
        printf("%c%c\n", *(byte*)0x400000, *(byte*)0x400001);
    }

This works on DMC, tcc, mcc, lccwin, but not gcc because that loads 
programs at high addresses. The problem being that the address involved, 
while belonging to the program, is outside of any C data objects.