Item — HN Reader

This was a good read. I instantly recognized the title of the textbook that is mentioned in the blogpost? I own it!

Having a background in C, I went back and forth with Ada for years, without really jumping all in. In the last couple years in particular, with the growing popularity of Rust, I started to renew my interest.

I'm reminded of a popular reddit thread on r/Ada-- someone called Rust a "toy language", which prompted the valid response that Rust is being used in a lot of commercial products lately. The response[0] kind of brings home the caliber that Ada is capable of, starting with: > Rust being used in commercial products isn’t really the same ballpark as what I’m talking about. It’s not even the same game.

It seems like the easiest way to trend on HN is to make a post such as "<old software> rewritten in Rust", but each time I see more and more people advertising Rust, I just wonder why Ada didn't get the credit it deserved as being absolutely bulletproof. Eventually, I came across an "Ada Manifesto" of sorts [1] that finally pushed me to "put my money where my mouth is" and start going all in with the language. (the same author of that "Manifesto" maintained a "Should have Used Ada"[2] series for a while that points out just how using Ada could have stopped certain security vulnerabilities from ever being a problem in the first place)

Ada is anything but dead and there's a lot of interesting things coming out for the 202x specification. I hope to see community enthusiasm grow as people begin to shift their interest more and more to safe languages.

[0]: https://old.reddit.com/r/ada/comments/js6edd/regarding_this_... [1]: https://old.reddit.com/r/ada/comments/7p12n3/going_allin_wit... [2]: https://annexi-strayline.com/blog/

2 comments

> I just wonder why Ada didn't get the credit it deserved as being absolutely bulletproof

It's not. All languages make trade-offs in the performance-convenience-safety-etc space, and Ada's choice is not "100% safety". It lacks memory safety and has holes in its type system: https://www.enyo.de/fw/notes/ada-type-safety.html

I wouldn't say Ada lacks memory safety. It doesn't go for 100%-in-all-cases but neither does Rust. The main differences are that it doesn't do memory safety by default (which is significant), and also treats memory safety with less granularity.

Aside from simply making manual memory management less frequent (with things like variably sized arrays), it has memory pools and subpools to handle more large-scale memory safety issues. Essentially you can define the scope for all allocations of a type.

It's an interesting tradeoff, though unfortunately I haven't seen much discussion about it.

I think it’s time we start expecting 100% memory safety as table stakes, because any flaws are catastrophic. Moore’s Law has more than paid for it; Android could run an animated display and a Bluetooth stack in a wristwatch seven years ago.

One area where I think Ada has the edge is providing language constructs that make bare metal programming safer. Concepts like 'dangling pointers' and 'memory leaks' aren't relevant in a programming environment without a heap. In bare-metal programming on a microcontroller you're more likely working within a flat memory model where the 'memory safety' provided by some modern programming languages is less relevant. Arguably, this is the context within which safety-critical programming is actually happening.

You can absolutely cause a pointer to dangle without heap allocation. Pointers can point to the stack too. You also have stuff like iterator invalidation, which is sort of a special case of a dangling pointer.

I do bare metal programming. I have a macro + linker widget called stack_allocated_ptr(x)

So I can write guards like

   if(stack_allocated_ptr(thingie))
   { 
     exit_critical_error( "oopies");
   }

You're absolutely right. Pardon me. I should have written the more specific 'use-after-free'.

For many attempts, like Rust, I don't think the problem is related to Moore's Law at all. It's more a matter of dev time, effort, and expertise.

And even then, I don't think Rust's mechanisms even can be 100% as they are now.

Ada's pools are probably the one that is most related to Moore's Law and actually capable of 100%, or so I'd expect.

You can write massive programs without a pointer in sight. If you have to import any C, then it's made a lot worse. You're better off doing memory mapped register type stuff in Ada.

Is Unchecked_Deallocation still necessary? If so, then it is hard for me to take seriously any claims of Ada's safety.

There's a LOT of things that it's not necessary for; watch this video: https://archive.fosdem.org/2016/schedule/event/ada_memory/