Fil-C: Garbage In, Memory Safety Out [video]
Fil-C, a project by Filip Pizlo, aims to bring robust memory safety to C and C++ without forcing a language rewrite, challenging the notion that these languages are inherently unsafe. This latest video presentation sparked intense Hacker News debate, centering on how Fil-C's dynamic runtime checks compare to Rust's compile-time guarantees. Commenters explore the philosophical differences in safety approaches and question Fil-C's real-world applicability and claims of perfection.
The Lowdown
The video "Fil-C: Garbage In, Memory Safety Out!" by Filip Pizlo, presented at SSW 2026, introduces Fil-C, a novel implementation of C and C++ designed to achieve memory safety levels comparable to modern, safer languages. Pizlo directly confronts the conventional wisdom that C/C++ are prone to memory safety exploits, arguing that his compiler and language runtime can effectively mitigate these risks.
- Core Problem: C and C++ are notorious for memory safety vulnerabilities, leading to widespread calls for rewriting codebases in languages like Rust.
- Fil-C's Solution: It proposes a C/C++ implementation that integrates sophisticated runtime checks to prevent memory safety exploits, even in the presence of complex bugs.
- Technical Focus: The talk delves into the specifics of Fil-C's compiler, its runtime environment, and a corpus of existing software that has been successfully ported to it, demonstrating its practical viability.
- Project Goal: To provide a path for developers to retain their existing C/C++ codebases while gaining the memory safety benefits typically associated with newer languages.
In essence, Fil-C positions itself as a significant development that could drastically alter the landscape of C/C++ programming by offering a compelling alternative to wholesale code migration for security-conscious projects.
The Gossip
Fierce Fil-C vs. Rust Fray
Discussions frequently pitted Fil-C's approach to memory safety against Rust's. Commenters debated whether Fil-C's runtime validation of syscalls (like mmap) offered a superior, more practical form of safety compared to Rust's compile-time guarantees and explicit unsafe blocks. Critics argued that Fil-C's claims of universal safety might be overstated, especially when interfacing with the underlying "unsafe" system libc, and expressed frustration over perceived "blindness to problems" and "false perfection" claims from the Fil-C camp, contrasting it with Rust's more open engagement with criticism. Proponents highlighted Fil-C's ability to make traditionally unsafe C operations, including setjmp/longjmp, safe at runtime.
Kernel and Ecosystem Integration Quandaries
The conversation extended to the broader applicability of Fil-C, particularly its potential integration into operating system kernels and other ecosystems like Cython. Questions arose about whether Fil-C's memory management model (possibly involving GC) could function effectively within a kernel environment. Commenters also debated the feasibility of extending Fil-C's safety features to complex syscalls (e.g., process_vm_writev, ptrace), and whether the performance overhead of dynamic checks would be acceptable in performance-critical areas like Cython extensions, where explicit opt-outs for speed are common.
Static vs. Dynamic Bounds Deliberations
A subset of the discussion focused on the nuances of array bounds checking and memory safety guarantees, contrasting static (compile-time) and dynamic (runtime) approaches. While Rust provides dynamic checks for array indexing, and static guarantees for iterators, some users debated whether Rust could or should offer more static bounds checking for dynamic arrays. The complexity of achieving pervasive static proofs (as seen in languages like WUFFS or ATS) was acknowledged, and the practical balance between compiler assistance, runtime checks, and performance optimization (e.g., LLVM's bounds check elision) was a key point of consideration.