logoalt Hacker News

mirashiiyesterday at 4:59 PM1 replyview on HN

> The Fil-C runtime is tiny compared to TS and C#

Sure, this is a simple fact.

> So Fil-C is safer than those

This is not a simple fact that follows, and a good example of why you seem to be catching so much criticism for overly bold claims. One could state that a smaller runtime is easier to audit, and so the investment needed to reach similar levels of safety is lower. One might even argue that after similar levels of investment, that the probability that it's safer is higher. But jumping all the way from lower number of lines => safer is a simple fact is a huge leap.


Replies

pizlonatoryesterday at 5:28 PM

I have worked on both a major JS runtime and a .NET runtime. I have fixed hundreds of security bugs in JSC. Based on that, I have no doubt that what Fil-C does is safer. Just the absence of a JIT makes it safer in a way that I don’t think is seriously debatable. Even with JIT disabled, a JS runtime has massive attack surface due to the language relying on a large native library to do anything useful, not to mention a mind boggling amount of language implementation corner cases.

By contrast Fil-C has a small number of rules and largely obviates the need for “native” code.