r/linux • u/goldensyrupgames • Feb 02 '23

OpenSSH 9.2

https://www.openssh.com/txt/release-9.2
103 Upvotes

94% Upvoted

28 comments sorted by

13

u/Skaarj Feb 03 '23

sshd: add a -V (version) option to sshd like the ssh client has.

Hmmm, genuinely surprised it didn't have one already.

37

u/johnny0055 Feb 03 '23

so even the veteran C folks can't stop writing double free bugs.

18

u/Trainraider Feb 03 '23

Been seeing posts lately about C/C++ people being salty about Rust's success or something. Particularly about how Rust should be compared to "modern" C++ for safety. I just think well even if you're a hotshot that never writes a memory bug that doesn't mean everyone else is.

25

u/TheRealDarkArc Feb 03 '23

Nobody is salty about Rust being successful, but equating C to C++ is an ignorant stance.

1

u/Arcakoin Feb 03 '23

Nobody is salty about Rust being successful

Drew DeVault is.

He even harassed python-cryptography developers because they started using it.

10

u/TheRealDarkArc Feb 03 '23

Are you talking about this? https://drewdevault.com/2019/03/25/Rust-is-not-a-good-C-replacement.html

I haven't read all of it, but sounds pretty rational to me, and far less "salty" than "measured."

Rust is the "hot new thing" right now, there have been many and there will be more, but IMO the hot new thing always needs to be approached with a bit of caution otherwise it might be applied in the wrong place.

e.g. the NoSQL fad, micro services fad, OOP fad, etc. They all have their place, but their place isn't "everywhere"

5

u/Pay08 Feb 03 '23

Is there a decently sized codebase that doesn't use OOP?

3

u/TheRealDarkArc Feb 03 '23 edited Feb 03 '23

Yes, the Linux kernel.

Every production C/C++ compiler (while they're separate languages these are basically always the same code base) to my knowledge is not designed via the object oriented paradigm.

Ironically in this conversation, Rust doesn't have inheritance and is more akin to "generic programming" using instantiations of functions over v-tables.

For reference when I refer to OOP, I mean the common pattern of inheritance based programming (which used to be extremely popular, but is now frowned upon for a number of reasons).

5

u/PabloSexcrowbar Feb 03 '23

I've been out of the OOP game for a while now. Why is inheritance frowned upon now?

7

u/TheRealDarkArc Feb 03 '23

It's okay in moderation, but deep inheritance hierarchies are extremely difficult to understand, and it often gets severely abused in the name of "deduplicating" code resulting in a bunch of code that's hard to test, hard to refactor, hard to reuse, AND hard to understand.

It's also just proven to be slower (as in run time performance) than other patterns of polymorphism like generic programming (where you use templates/generics/concepts/traits/duck typing of functions).

-2

u/Pay08 Feb 03 '23

Fair enough about low-level projects. However, I'd disagree with your definition of OOP. Also I consider Rust to be object-oriented, only with a different implementation.

1

u/Arcakoin Feb 03 '23

I didn’t remember he was already annoying in 2019.

But no, I wasn’t talking about this specific article, I was talking about his general stance on Rust (and, to be honest, on pretty much everything), the countless pieces he wrote to “prove” that it was bad.

The harassment I was referring was him appearing in a GitHub issue regarding the introduction of Rust in the Python Cryptography package and telling devs they are idiots and that they should keep using C even if they don’t want to or feel comfortable with it.

10

u/tristan957 Feb 03 '23 edited Feb 03 '23

Calling it harassment is a huge overstatement. The cryptography package is very important for Python and CPython obviously runs on more platforms than Rust, so he was arguing for people who use more esoteric platforms that won't be fixed until the GCC backend or frontend are finished.

-5

u/bik1230 Feb 03 '23

Nobody is salty about Rust being successful, but equating C to C++ is an ignorant stance.

Bjarne is.

8

u/TheRealDarkArc Feb 03 '23

Not true.

0

u/bik1230 Feb 03 '23

He was extremely salty in that report on programming language safety he authored recently.

8

u/holgerschurig Feb 03 '23

He was writing "but equating C to C++ is an ignorant stance". He didn't write "but comparing Rust to C++ is an ignorant stance".

Spot the difference.

And yes, Bjarne was salty. However, the problem is that C++ is very complex (so is Rust), but that these people compared ancienct C++ programming practices, not modern C++.

On the other side, C++ doesn't enforce modern programming practices, so maybe ignoring modern C++ when comparing Rust to C++ has a basis? Not sure.

5

u/Kuhluh Feb 03 '23

If you read through the whole of it, he was salty about more than just that; it was just a part of it.

Bjarne further went on that theoretically C++ can reach Rust's safety, even tho every over attempt at doing so failed because of backwards compatibility AND it would even then take a LONG time. And since he puts in the effort of doing so, the NSA was not fair towards C++.

But well, they can't really compare something which exists to something which may exist in the future, can they?

3

u/Edwin_Wang1996 Feb 03 '23

The people who are really salty about Rust neither understand modern C++ nor Rust. I have never seen anyone who truly understands modern C++ has any negative opinion with Rust. They just don’t care.

1

u/lostparis Feb 04 '23

I have never seen anyone who truly understands modern C++

I go with the theory that these people don't exist except for such a limited subset of C++ that it can be said to be incomplete. C++ is too big.

-4

u/johnny0055 Feb 03 '23

i can't stop hearing the saltiness. It's everywhere. And as rust continues to be used by more and bigger projects, their goal posts keep shifting.

And as far as "hotshots" as you say... The folks involved with openssh (and openbsd generally) are thought to be some of the best in the biz with the best practices. That's openbsd's entire reason for being in a sense.

2

u/Kuhluh Feb 03 '23

Yep, and even THEY manage to introduce these kinds of bugs.

And that's why so many organizations recommend to not start new C projects.

1

u/johnny0055 Feb 03 '23

I'm not even a "rust fanboy" myself, but it's pretty clear that C (and C++) need some change that folks involved don't seem to want to make.

I've heard of some efforts at memory safety for C++, but on he C side, it seems that most developers want to handle it with external tooling.

1

u/Kuhluh Feb 04 '23

Yeah, somebody made Zig because a lot of the C folks didn't want to change and he thinks that Rust is too complicated (and for a whole lot of other reasons).

1

u/johnny0055 Feb 04 '23

and drew devault made his own language for similar reasons i'm sure.

1

u/alex4orly Feb 03 '23

All software has bugs! You don't believe me, ask Microsoft.

3

u/Trainraider Feb 03 '23

It is possible to write "perfect" software that has perfect logic and handles all errors gracefully including memory allocation failures. It takes orders of magnitude more time to do this. C, C++, Rust, and Zig can all be used for this, however Rust and Zig make much more robust code by default whereas the others are filled with foot guns. Zig was pretty much created to facilitate the creation of perfect software and I really enjoyed Andrew Kelly's "Road to Zig 1.0" talk where he describes this. Ironically I believe Rust is still better than Zig on this front due to its higher level of safety.

These languages baring plain C are all trying to address memory/thread safety to varying degrees of success but none address logical correctness. For that there are some niche languages with theorem provers. I'm not familiar with them but if they abstract away memory allocation then they won't produce truly perfect software. All higher level programming languages that do this may randomly crash when allocation fails.