Comment by slopinthebag

Another comment said that returning a * was to avoid returning null which would crash users of the library who didn't check for null. That seems like a C smell to me

>because crypt in musl started returning "*" in some cases some years ago

In Rust, the type of the return value would be a `Result<T, E>`, which means the chain of events that led to this would never have started in the first place.

> How would using a language different than C help here?

Easier to formulate invariants and check/prove them. Better language correlates with safer software.

I write firmware where the program has to run for years unattended.

You are right, C with manual memory management, no lifetime management, lack of phat pointers and a culture of leet has problems with deranged maddening bugs that other languages don't have.

But this bug first shows how inband signaling is bad news usually. But worse it's a failure to adhere to the spec properly. If you implement a library and you don't adhere to the spec you're going to bone someone.

Perhaps even worse is obviously the spec doesn't come with any standard testing framework. That was also the root of Apples infamous goto bug.

why does this logic bug exist? why are they returning a string, why not a result type, (nil, err), or something else?

oh right, because c is a crusty old language with barely any features.

Rust would absolutely have saved you here. Even with `Result<String, String>`, which is pretty poor design, there's no confusing `Ok(s)` with `Err(s)`. Sure you can go out of your way to write something like

    let hash = match result {
        OK(s) => s,
        Err(s) => s,
    };

but at that point I feel like the library is forgiven (except for the poor error design).

@my-huge-pony does make a good point elsewhere in the thread: if the potential error was not foreseen and the code was written originally to return `String` instead of `Result<String, Error>` then even Rust would be in a pickle.

It would, due to Result<T> and #[must_use] on it. Nobody would return “*” as a sentinel in Rust.

languages with more features would mean developers aren't choosing between unchecked NULLs or sentinel strings.

it's unbelievable to me that there isn't a larger movement of developers to move away from c towards better & safer languages. look at how much pushback the rust4linux folks get, primarily from c developers who are simply afraid of change. imagine engineers not adopting safer building practices because "they prefer the old way"....it's disgusting honestly.

what will it take to move away from c? older devs retiring. Planck said that "science advances one funeral at a time" and i fear it will be the same for software.

no rust programmer would ever return a sentinel string like this.

Cars without seatbelts and airbags chopping off driver's heads in relatively slow collisions? Well guess what, that could happen in a modern car as well if the driver sticks their head out the window while going through a very tight tunnel!