Fil-C

“optimization passes are still able to do things that wouldn't be possible without UB, like falling through functions and deleting safety checks inserted by the Fil-C runtime”

“There is now an iron clad defense against all memory safety bugs leading to RCE that is actually practical to use in production in many cases”

“This improves the situation greatly by converting most interesting cases of unsound behavior into runtime errors.”

“it has stronger memory safety guarantees than rust, none of the compatibility issues that a wholesale rewrite has”

“Fil-C takes one particular class of allocation related bugs and UB off the table, but leaves many of them behind.”

“you need Fil-C or similar runtime handling so that any time its behaviour would become undefined the program exits instead”

“intra object overflows are almost never useful for memory corruption exploits unless they let you corrupt a pointer”

“chosen a definition of memory safety that specifically excludes a bunch of overflow vulnerabilities and type confusion”

“Tools like Fil-C, hardened mallocs like SlimGuard, and other "make C safe" solutions all sacrifice absurd amounts of performance”

“Technical innovation is memory safety with high level of compatibility with existing C and C++ in practice.”

“what I like is that it works with existing C++ code; I don't think the extra safety relative to Rust is worth the performance penalty”

“In Fil-C, no such specialists are needed, and the pool of unsafety is closed and fixed, no matter what programs, algorithms, data structures you use.”

“When I write new code in Fil-C, I just lean into the GC all the way, which makes programming in C and C++ so much nicer.”

“Sure, GC's are nice which is why so many langs have them, but that removes the deterministic allocation performance which most C/C++ programmers want”

“the comparison becomes a bit apples vs pears when bragging about how much more memory-safe Fil-C is than Rust”

“The thing that makes races hard to debug in C or C++ is memory corruption; that doesn't happen in Fil-C”

“Those languages rely on a much larger pile of YOLO C/C++ code for their runtimes and standard libraries than Fil-C does.”

“let me know when I can call process_vm_writev or ptrace and have Fil-C verify safety properties on the result.”

“Caught multiple memory safety issues in a nice deterministic way, so designing the object model was easier than it would have been otherwise.”

“I don't think fil-c is a drop in C replacement, there are things you can do in C such as certain types of pointer abuse that fil-c prohibits”

“Not everyone wants to recompile the whole app and dependencies with filc to get a slowdown, extra memory use and safety.”

“Fil-C will panic your program, or give some kind of memory safe outcome (that is of no use to the attacker)”

“It's a fantastic piece of work (I reviewed some part of it) that will very likely play an important role in the future”

“Fil-C makes a lot of sense to me if the goal is to simply take existing legacy software and recompile it in a more memory safe way”

“sudo compiled with Fil-C: uses pam compiled with Fil-C, and all of pam's dependencies are compiled with Fil-C, so the whole thing is memory safe.”

“It might have a beautiful niche for safely sandboxing legacy code. But I don't see any compelling reason to use it for new code.”

“easy wins that could make the world less fragile with a much smaller intermediate effort, eg with something like FilC”

“The performance drop of Fil-C (as described in the article) limits the usage, and the GC (independently) limits the usage.”

“Compiling it using Fil-C is a nice academic exercise but not really helpful, since the whole point of those custom data structures is peak performance.”

“for this to work, tracing GC can not be used. And this is what prevents Fil-C and many other languages to be used in that area.”

“If Fil-C can fulfill its promise to make old C code memory safe, it will be a massive benefit to the world.”

“I can write the networking parts in Rust and the rest of the program in C, but apparently can't do the same with Fil-C.”

“Choosing to use Fil-C to recompile existing (established, stabilized, functional...) software rather than rewrite it is an engineering choice.”

“the niche is rebuilding your entire GNU/Linux userland with full memory safety and completely acceptable performance”

“As far as I understand, Fil-C changes the ABI of the system, therefore it requires a new architecture in Debian terminology”

“The main advantage of Fil-C is compatibility with C, in a secure way. The disadvantages are speed, and garbage collection.”

“The code I've seen that was autotranslated from C to Rust has an absolutely hopeless number of unsafe statements.”

“So, with Fil-C, there would be no need to ruffle feathers by telling port maintainers to support a new toolchain!”

“Fil-C is and despite its originator's confidence always will be bigger and slower than what you have today”

“Bringing up the fil-C toolchain on weird ports is probably less work than bringing up the Rust toolchain”