Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>Zig has very little focus on safety and has had several regressions related to security and correctness, most of which Andrew has said he doesn't care about as much.

can you be a bit more specific?



A regression appeared where members were accessible outside of their scopes even without the `pub` modifier. This took months to fix and the person bringing it up initially was yelled at about not understanding programming languages in the discord channel.

Another one I personally brought up was that the standard library's utf-8 module had a decoder that panics on invalid input sequences, certainly setting consumers up for DOS attacks with malformed utf-8 inputs. EDIT: DOS vulnerability is still there (https://github.com/ziglang/zig/blob/master/lib/std/unicode.z..., PR to fix that was closed https://github.com/ziglang/zig/pull/4929). I never responded to the PR because it was at that moment I decided to abandon Zig altogether.

The response to the latter was pretty much "the standard library isn't meant to be used right now", to which I really don't have a response. There was a very, very long and heated argument in the discord channel about it where instead of addressing the concerns about DOS and security I was instead insulted for apparently trying to taint an otherwise perfect language.

The community is vile and the few examples I've seen of the maintainer disregarding safety and security in this way don't give me any amount of confidence in the project overall.

EDIT: Worth mentioning, the syntax and semantics surrounding Zig are not new ideas. I'm sure another project will pop up at some point to compete; many discussions I've seen in the language design channels on IRC and a few discord servers have many people arriving at similar conclusions Zig has made, without knowing Zig even exists. I think we're slowly converging on a language that looks a lot like Zig, but I don't think Zig will be its ultimate incarnation.


Looking at that unicode PR, It seems like the thought process is "we don't want to spend time fixing unicode security regressions until we have stabilized the rest of the language", the unicode library is totally broken rn, don't fix a minor part of the problem.


There is no excuse, in my opinion. The PR would have taken a step in a safer direction, even if the entirety of it is scrapped at a later date. It wouldn't have broken anything else in the codebase, and it was a completed, merge-able change.

Again, the frustration wasn't just from the PR alone - it was also the Discord flame war that ensued prior to the PR.


While I'm not usually 100% happy with the Discord server (it currently has very little moderation and has had one user behave like a piece of shit for a long time) I've had a hard time finding the flame war you mention. I found the discussion about utf8 decoding and it seemed cordial, with two people agreeing with you and only one saying (paraphrasing...) "Fuck this, I'm leaving this community until people stop asking too much" (which didn't make much sense).

I usually find community overrated and I've made a conscious effort to separate it from technology for the most part. Zig as a language has certain values that it's built with in mind and those values for the most part are aligned with mine, so this is basically what keeps me interested in it. I would use Rust despite its community if it aligned with my values. I despise the leadership of Elixir and Phoenix but I still use both of those when it makes sense.

With all this said, the IRC channel is a lot less about memery and wild discussions (but also less active) than the Discord server, so if you feel like it you can always just pop into #zig on FreeNode if you have questions and would like to talk about the language.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: