Rusty Russell

I like Rusty Russell's classic "Hard to Misuse Interface Levels". The first couple of items are 0: Impossible to get wrong/DWIM 1: Compiler/linker won't let you get it wrong ...through 9: Read the correct LKML thread and you'll get it right - SET_MODULE_OWNER ...all the way up to 17. I'll let you discover the rest yourself :-) https://ozlabs.org/~rusty/ols-2003-keynote/img39.html

> Replacing [] with at, eliminates the vulnerability. And for decades of C and C++ programmers, [] is still the most obvious way to index an array. And the most obvious way creates potential security vulnerabilities. See Rusty Russell's classic "easy to use versus hard to misuse" posts: http://ozlabs.org/~rusty/index.cgi/tech/2008-03-30.html and https://ozlabs.org/~rusty/index.cgi/tech/2008-04-01.html .

I always liked Rusty's list on making an API "hard to misuse" (and its followup): https://ozlabs.org/~rusty/index.cgi/tech/2008-03-30.html https://ozlabs.org/~rusty/index.cgi/tech/2008-04-01.html

> everybody could (and should?) just start declaring size parameters before their respective buffer parameters in new code I know that was a common opinion pre-C23, but it feels like the committee trying to reshape the world to their desires (and their designs). It's a longstanding convention that C APIs accept (address, length) pairs in that order. So changing that will already get you a score of -4 on the Hard to Misuse List[1], for "Follow common convention and you'll get it wrong". (The sole old exception in the standard is the signature of main(), but that's somewhat vindicated by the fact that nobody really needs to call main(); there is a new exception in the standard in the form of Meneide's conversion APIs[2], which I seriously dislike for that reason.) The reason I was asking is that 'uecker said it was requested at the committee draft stage for C23 by some of the national standards orgs. That's already ancient history of course, but I hoped the idea itself was still alive, specifically because I don't want to end up in the world where half of C APIs are (address, length) and half are (length, address), when the former is one of the few C conventions most everyone agrees on currently. [1] https://ozlabs.org/~rusty/index.cgi/tech/2008-04-01.html [2] https://thephd.dev/_vendor/future_cxx/papers/C%20-%20Restartable%20and…

Here are the original lists: How Do I Make This Hard to Misuse? - https://ozlabs.org/~rusty/index.cgi/tech/2008-03-30.html What If I Don't Actually Like My Users? - https://ozlabs.org/~rusty/index.cgi/tech/2008-04-01.html

A famous guide to evaluate your APIs: - https://ozlabs.org/~rusty/index.cgi/tech/2008-03-30.html - https://ozlabs.org/~rusty/index.cgi/tech/2008-04-01.html

And there are those two links, that are very good: https://ozlabs.org/~rusty/index.cgi/tech/2008-03-30.html https://ozlabs.org/~rusty/index.cgi/tech/2008-04-01.html

Rusty's API scale captures this approach really well: How Do I Make This Hard to Misuse? https://ozlabs.org/~rusty/index.cgi/tech/2008-03-30.html What If I Don't Actually Like My Users? https://ozlabs.org/~rusty/index.cgi/tech/2008-04-01.html

In case someone is curious about the original presentation https://ozlabs.org/~rusty/ols-2003-keynote/img39.html

You reply to the email saying 'sorry, but we can't accept your code because...'. (The shortest way to do this is to just reply saying 'NAK', but I agree with Rusty Russell that nak-mails are generally unfriendly and a bad idea: http://ozlabs.org/~rusty/index.cgi/tech/2007-05-04.html)

> It's an order of magnitude more difficult to make a meaningful contribution to the Linux kernel Any contribution that is kept is meaningful. He could start by taking the Eudyptula Challenge: https://www.linux.com/blog/learn-how-contribute-linux-kernel-take-eudy… Or he could read one of the many other resources out there about how to get started: https://www.linux.com/news/three-ways-beginners-contribute-linux-kerne… https://kernelnewbies.org/ https://www.quora.com/What-is-the-best-way-to-start-contributing-to-th… https://www.kernel.org/doc/Documentation/development-process/1.Intro https://www.kernel.org/doc/Documentation/SubmittingPatches http://helenfornazier.blogspot.com/2015/06/linux-kernel-how-to-start-c… http://ozlabs.org/~rusty/Stupidity.html http://stackoverflow.com/questions/4576332/i-want-to-contribute-to-the… ...

Note the "Hard to Misuse" list is at http://ozlabs.org/~rusty/index.cgi/tech/2008-03-30.html

"I would suggest re-naming "rmbdd()". I _assume_ that "dd" stands for "data dependent", but quite frankly, "rmbdd" looks like the standard IBM "we lost every vowel ever invented" kind of assembly lanaguage to me. I'm sure that having programmed PPC assembly language, you find it very natural (IBM motto: "We found five vowels hiding in a corner, and we used them _all_ for the 'eieio' instruction so that we wouldn't have to use them anywhere else")." -- Linus Torvalds, LKML (http://ozlabs.org/~rusty/linux.conf.au-2004-emails.txt)

The simple truth of the matter is that there is no urgent action required. Blocks are only just now half full on average. http://ozlabs.org/~rusty/diagrams/blocksize-pretty.svg

I agree the "send me differences" model is appealing. A version based off rsync was created back in 1999 but patents killed it. I think the patent in question runs out pretty soon though... The Tragedy of the RProxy: http://ozlabs.org/~rusty/rproxy.html

Some background reading that may make this help makes sense to folks from outside the domain: https://www.ozlabs.org/~rusty/virtio-spec/virtio-paper.pdf Block storage (virtio-block) is way simpler than file systems, both in the virtio implementation and in the host filesystem implementation. Simple is good, both for security reasons and because it makes it easier to reason about performance isolation between guests. The cost is obviously in features, and in making it hard to share data (and very hard to multi-master data) between multiple VMs. To see how simple virtio-block is, take a look at Firecracker's implementation (https://github.com/firecracker-microvm/firecracker/blob/master/devices… The existing alternative, as the post talks about, is 9p which has a lot of shortcomings, so this is interesting. I suspect it's use is mostly going to be in development environments and client-side uses of containers, and server-side users of virtualization will likely stick with block (or filesystem implemented in guest userland).