Thread: Your most used compiler

>> You can now proceed to http://gnu.org/even_more to receive your free, signed "RMS" beer stein -- made of solid 'pewter!

You mean free...as in beer?

>> Now see, those types of warning should be enabled by default, no?

Sure and why not warn about the use of void pointers, or malloc, or any other thing that could cause problems? What's next - code formatting advice from the compiler?

"Warning (Line 3114): the use of tabs is considered bad form".

That isn't a compiler's job IMO. It's all about delegation of concerns. Hell, the compiler doesn't even know *a priori* what function you're linking to, so it really has no business making assumptions, anyway.

Originally Posted by cpjust

That's one of the functions of an IDE; but a good IDE also highlights code syntax, takes you directly to the lines causing compile errors, lets you debug code, does auto-completion as you type names of functions, has integrated help about classes/functions where you can just click on the name of the class/function and press a key to learn how to use it, shows you the type of a variable when you put your mouse over the variable name... All very useful things to have when programming.

Along with syntax highlighting, auto indentation is a text editor feature, not something that involves tool integration. Even auto-completion and integrated help, especially where it is limited to the standard library (and perhaps specific other libraries) can be considered pure editor features, to some extent.

Originally Posted by whiteflags

Also I laughed at the whole security wizards thing. Thanks Elysia! It seems a wee contradictory that a bunch of "security wizards" would have so many security problems with their products. Really I don't see how microsoft is any more focused on security than any other company. Calling them security wizards because they tacked on a few warnings in their dev software suggests a very narrow perspective on what security is on the part of the claimant.

Originally Posted by cpjust

Symantec is a 'security wizard'. Microsoft is only starting to take security seriously, and they have a long way to go.

Ah, but Microsoft spits out lots of security releases each month. They're also, while not a security company, very serious about security. They have released a lot of things related to security. Anti-virus tools, anti-malware tools, firewall, etc.
And the "safer" C library functions.
So I think it's fair to call them security wizards since they are very adamant about security.

Originally Posted by Sebastiani

Sure and why not warn about the use of void pointers, or malloc, or any other thing that could cause problems? What's next - code formatting advice from the compiler?

"Warning (Line 3114): the use of tabs is considered bad form".

That isn't a compiler's job IMO. It's all about delegation of concerns. Hell, the compiler doesn't even know *a priori* what function you're linking to, so it really has no business making assumptions, anyway.

A compiler should possibly warn if malloc/void* was used in C++, if you ask me. Absolutely not in C, though, since they're integral there.
A compiler is a tool to not only compile your code, but to catch your mistakes too (to a certain extent), so I think it's fair.

Eh, you're missing the point.
Microsoft is concerned about security. Vista was all about security. They promote IE8 because of security, etc.
So it wouldn't strike me as strange that they added "safe" functions.
And btw, they're more like debugging tools than real functions, since they just throw an assertion. And I don't think they're difficult to understand. If you fail to understand them, then you shouldn't call yourself a C programmer.

I'm not impressed.
And if you know of a better way to detect such stuff in C, then name it.

Originally Posted by Elysia

And if you know of a better way to detect such stuff in C, then name it.

I do not have today the same annoyed expression I would have a couple of years ago when discussing the so-called "safe functions". However I still think these are at large useless since buffer overflow is first a bug before it ever becomes a security issue. None of these so-called "safe functions" offered by Microsoft or OpenBSD or even the C Standards Committee really address the issue, since they can only operate with the programmer's consent.

Personally, I favor canary solutions like ssp. Especially ssp. Not StackGuard which is only marginally more useful than the so-called "safe functions" and which is what Microsoft uses with that /GS switch of them. In any case, these solutions plant the protection downstream at program compilation and execution. Exactly where it provides more safety. Not in the programmer's hand where usually all the damage comes from.

I'd probably complement that with a standard library wrapper like Libsafe and ignore altogether the so-called "safe functions" (with the exception of C standard functions). So, there's one upstream solution (libsafe) and one downstream solution (ssp).

Again, buffer overflow is first a bug before it ever becomes a security issue. If there is a need to actually solve the problem (solving = minimizing the impact) then this really has to be done by treating C and C++ programmers as they deserve; a bunch of incompetent fools that need their code to be nursed.

EDIT: Naturally I said last bit because I felt it was something I needed to say. It annoys me the way we like to wash our hands of the buffer overrun problem as if it was a flaw of the compiler, or operating system, or whatever. But in all truth the point is that there are other, better solutions. "Safe functions" address the problem by putting the solution back in the hands of those that create the problem in the first place. There's no guarantee of success since most people actually don't use these functions. Some don't even know they can use OpenBSD's much better strlcpy in their standard library, for instance. Sure keep them around, but a real solution has to include elimination and prevention techniques like the ones described above.

Originally Posted by Mario F.

...If there is a need to actually solve the problem (solving = minimizing the impact) then this really has to be done by treating C and C++ programmers as they deserve; a bunch of incompetents that need their code to be nursed.

Harsh! But I like it

Originally Posted by laserlight

Along with syntax highlighting, auto indentation is a text editor feature, not something that involves tool integration. Even auto-completion and integrated help, especially where it is limited to the standard library (and perhaps specific other libraries) can be considered pure editor features, to some extent.

No, you're thinking of a particular subset of text editors which do more then just edit text.
If you were using a real basic text editor like Notepad, there's no highlighting, auto-indenting or anything else.
Also, editors like vi don't do anything special by default unless you turn on those features, and that would require the student to learn vi as well as C/C++, so why not just use an IDE to begin with? You don't have to compile with it if you really don't want to, but clicking 1 button to compile & run it couldn't get much simpler, could it?

Originally Posted by cpjust

That's one of the functions of an IDE; but a good IDE also highlights code syntax, takes you directly to the lines causing compile errors, lets you debug code, does auto-completion as you type names of functions, has integrated help about classes/functions where you can just click on the name of the class/function and press a key to learn how to use it, shows you the type of a variable when you put your mouse over the variable name... All very useful things to have when programming.

I wasn't gonna say anything until I saw this:

Originally Posted by cpjust

Also, editors like vi don't do anything special by default unless you turn on those features, and that would require the student to learn vi as well as C/C++, so why not just use an IDE to begin with?

You can do everything in the first paragraph with vim, you just have to figure out how to do it because the functionality is so "discrete". And altho vim is the best program of all time bar none, it is still just a text editor.

Which maybe forces you to think about the issue a little more -- eg. "Why I am trying to figure out how to do this like this, even if it is possible?" Do you really want to be looking up commands using your text editor at the same time as you use it to program? Since the operating system is already an "integrated thing" aren't there already a whole bunch of ways right in front of your face to do this? You make it sound very nice, and then I think of looking at eclipse again and thinking wow, this is a neat idea but the reality of the implimentation reveals something about reality.

Seperate tools is a better idea.

GCC - it pretty much compiles everything. But I've been using clang more and more lately since it's got a whole host of things that I think make it a better compiler (for C anyway... right now,) and pretty full GCC compatibility as well.

Originally Posted by MK27

Which maybe forces you to think about the issue a little more -- eg. "Why I am trying to figure out how to do this like this, even if it is possible?" Do you really want to be looking up commands using your text editor at the same time as you use it to program? Since the operating system is already an "integrated thing" aren't there already a whole bunch of ways right in front of your face to do this? You make it sound very nice, and then I think of looking at eclipse again and thinking wow, this is a neat idea but the reality of the implimentation reveals something about reality.

That's what an IDE is for, MK.
Some IDEs do this wonderfully (eg Visual Studio), and everything in one solution is always preferred to several programs to do it. That is, if it works as it should.

Originally Posted by cpjust

No, you're thinking of a particular subset of text editors which do more then just edit text.

Not really: indentation is part of text editing, and syntax highlighting is a natural part of how text might be displayed. In fact, it sounds like you agree with me, since you call them text editors. If they do more than edit text, then they must have been integrated with some other tool, hence they are IDEs. That said, the lines between a powerful text editor and a lightweight IDE are blurred... but as mentioned I think the key to this differentiation is whether tool integration is required for a given feature (but distinguishing between a tool and a feature of a tool can be difficult, since IDEs themselves can be considered tools in their own right).

Originally Posted by cpjust

If you were using a real basic text editor like Notepad, there's no highlighting, auto-indenting or anything else.

Yes, but that has no bearing on whether those features are part of an IDE or can be part of a "mere" text editor.