[Vm-dev] C-Based Toolchain Hardening

[Ben Coman]

The more experienced here probably know a lot of this, but I found it
quite interesting so I thought I'd share...

https://www.owasp.org/index.php/C-Based_Toolchain_Hardening

My biggest take away is the emphasis on using asserts.  My
professional C programming experience was only a short stint 20 years
ago in a graduate position where asserts were never discussed.  So
I've never used asserts and it was particularly enlightening to
read... "in the time it takes for you to write a printf or NSLog
statement, you could have written an assert. Unlike the printf or
NSLog which are often removed when no longer needed, the assert stays
active forever."

In relation to my own (potential) contributions to the VM, I'd be
interested to learn if there are any particular aspects from that
article that particularly:
* resonate with current practices
* areas that could be improved
* are adverse to personal experience

Of course there are already production, debug and assert builds.  And
it concurs with what I've read on the list about avoiding autotools.
The problem with dependency rebuilds when CFLAGS change between
production/debug builds was enlightening (if obvious in hindsight).  I
guess this is why each build type has its own directory.

One thing I don't quite get is "Everywhere you place an if statement
for validation or checking, you should have an assert. Everywhere you
have an assert for validation or checking, you should have an if
statement. They go hand-in-hand."
Indeed, perusing asserts in the repository [1] doesn't show any nearby
if statements, so maybe that statement is a stretch??

[1] https://github.com/OpenSmalltalk/opensmalltalk-vm/search?l=c&q=assert&type=Code&utf8=%E2%9C%93

cheers -ben