February 05, 2005

Gosling on unsafe code

In a recent talk about .Net, James Gosling made the following comment:

Microsoft’s decision to support C and C++ in the common language runtime in .NET one of the "biggest and most offensive mistakes that they could have made".

More specifically, James is referring to .Net's ability to support both "managed" and "unsafe" code, and he is clearly showing he doesn't really understand the issues at stake:  failing to support unsafe code would make .Net unable to run legacy code, which is of course unacceptable for Microsoft and millions of Windows users.

James is also conveniently forgetting that his employer's business is based on an operating system, which is written in...  C++.

The difference being that Solaris is written 100% in this "unsafe code" that James despises so much, whereas Microsoft is busy progressively replacing unsafe code with managed one in Windows.

It's sad that even somebody like James seems to forget that at the end of the day, good code comes from programmers, not languages.

Posted by cedric at February 5, 2005 07:22 AM

I think you're being a little disingenuous... nobody is going to run Word or other large C++ applications under .NET; millions of windows users don't really care if .NET can't run unsafe code.

Posted by: Jonathan Ellis at February 5, 2005 08:16 AM

i thing Gosling's comments are very exaggerated by the IT media, and blogs. The truth is, C and C++ are not suited for managed code, and in the article it says nobody actually uses managed C++ in real life applications. you must make a reality check over the issue that winows is re-written using managed code.. yes programmers write good code, but they need something better than C++ for that.

Posted by: aaa at February 5, 2005 09:52 AM

Hmm, the way I see it. James is not really attacking C/C++, he's only pointing out that Microsoft's decision to support those in CLR in .NET .

Providing Microsoft's track record in security, supporting C/C++ will open another can of worm.

> good code comes from programmers, not languages.
Exactly. That's why I think it's sad you misunderstood James' comment. Are you going to say that everyone doing .NET is good programmer?

Posted by: Jason Barker at February 5, 2005 10:00 AM

This ".NET is insecure because of unmanaged code" thing is really old, I was surprised to see it resurrected. The situation in .NET is very similar to the 'native' keyword in Java that allows arbitrary machine code to be linked in, making Java insecure. In both .NET and Java you have the choice to go fully VM, but you also have the option to open your vein to machine code if you really want. It's disingenous for Sun to blame Microsoft for this.

The difference between Java's 'native' and .NET's unmanaged code, btw, is that .NET works a whole lot better. It's a very clever system that allows you to subclass code in different languages.

I'm a big Java fan, but that doesn't mean I need to pretend .NET is evil.

Posted by: Nelson at February 5, 2005 03:21 PM

I was actually on a .NET dev team that used managed C++ back in 1998-99 time frame. What is now referred to as the C# language was a work in progress at the time. The core development of .NET was being written in a Java compiler that was modifed to emit IL for the CLR. The team I was on was writing an ORM (which got canned in favor of not muddying the waters for ADO.NET). We opted to use managed C++ because it was stable and what we all knew because we were all C++ Windows developers. At the time it was interesting and novel to write C++ for a garbage collected memory management system.

Posted by: rogerv at February 6, 2005 11:21 PM

Uh, Solaris is not written in C++. Try C. And assembler, forth, perl and probably others. But the kernel is mostly in C. You just don't do system work in C++.

Posted by: at February 17, 2005 11:01 PM
Post a comment

Remember personal info?