Fil-C: Garbage In, Memory Safety Out [video]

https://www.youtube.com/watch?v=5F-2Y1LPRek

26•Bootvis•23h ago

Comments

wasmperson•20h ago

He claims that all syscalls are safe because they're implemented by his custom libc, but that libc then calls out to the system libc, where the system calls are unsafe. He then claims that this is unlike rust, where making a syscall is unsafe. If you stick to the rust standard library in the same way that fil-c programs stick to the fil-c standard library, then all of your rust "system calls" are safe, too.

Someone in the audience also pointed out that a tool like this could be used to compile rust programs, not just C programs, in which case it's odd to hear Fil-C repeatedly framed as a language in opposition to rust rather than as a tool which might complement it.

cypherpunk666•48m ago

indeed, the ideas could be used more widely.

fil-c runs on linux.

what if linux ran on fil-c?

LoganDark•48m ago

> Someone in the audience also pointed out that a tool like this could be used to compile rust programs, not just C programs, in which case it's odd to hear Fil-C repeatedly framed as a language in opposition to rust rather than as a tool which might complement it.

You can combine both approaches for sure, but that doesn't change that they are indeed separate approaches. One (Rust) intends to characterize and prevent undefined behavior at compile time, and another (Fil-C) intends to make undefined behavior impossible at runtime, as evidenced by decisions like (for example) making unsafe usage of setjmp/longjmp safe.

You could sort of achieve "safety-in-depth" by combining both approaches, but Rust prefers to prevent all undefined behavior statically, and Fil-C prefers to focus on dynamic approaches. They have real differences, so that's probably what comes off as "oppositional"

raggi•44m ago

This presentation wasn’t too bad in terms of us vs theming, but in general throughout the lifetime of the project there’s been a strong us vs them rhetoric. I think it’s working as a marketing tactic to some extent but there are better, albeit harder ways to market the thing.

LoganDark•34m ago

Rust generally invites us vs them everywhere because it's just so ambitious and attractive (to some). Fil-C probably receives questions all the time about why they don't just do X or Y that Rust does. Maybe they end up supporting their position against that type of pressure and it looks like they're just opposing Rust when all they're doing is justifying themselves.

n42•44m ago

The combination of static safety gracefully degrading to runtime safety where not provable is interesting to me

LoganDark•26m ago

This is sort of already possible in Rust when you use safe primitives (e.g., RefCell), but it doesn't cover unsafe code invoking Undefined Behavior. Placing something like Fil-C around unsafe code could prove to be interesting, especially since current approaches rely on interpretation (Miri, Soteria Rust) rather than translation.

uecker•39m ago

Arguably the most important memory safety property, i.e. bounds checking for dynamic arrays, is also not statically checked in Rust.

cypherpunk666•44m ago

also: why not use fil-c to improve cython, and the ffi.

quotemstr•44m ago

Both Rust and Fil-C have unsafe blocks, but in Fil-C latter system, only Pizlo gets to write them. Why am I not filled with confidence?

modeless•35m ago

Rust doesn't runtime validate that your usage of syscalls is memory safe, while Fil-C does. For example you can call mmap in Fil-C and it is still guaranteed to be memory safe, while in Rust you can easily violate memory safety by calling mmap. This seems like an unambiguous improvement to me. This is as memory safe as it is possible to be on a system with a kernel that is not memory safe.

Adding Fil-C-like runtime checks to Rust is definitely an interesting direction.

LugosFergus•30m ago

I was just thinking that we were overdue for a Fil-C post on HN.

dang•23m ago

There are getting to be quite a lot of these so I'll do it CPS style:

Memory Safe Context Switching - https://news.ycombinator.com/item?id=48727177 - June 2026 (30 comments)

Memory Safe Inline Assembly - https://news.ycombinator.com/item?id=48606096 - June 2026 (47 comments)

The Fil-C Optimized Calling Convention - https://news.ycombinator.com/item?id=48162876 - May 2026 (32 comments)

A simplified model of Fil-C - https://news.ycombinator.com/item?id=47810872 - April 2026 (136 comments)

Pizlix: Memory Safe Linux from Scratch - https://news.ycombinator.com/item?id=46260852 - Dec 2025 (30 comments)

Linux Sandboxes and Fil-C - https://news.ycombinator.com/item?id=46259064 - Dec 2025 (156 comments)

Ported freetype, fontconfig, harfbuzz, and graphite to Fil-C - https://news.ycombinator.com/item?id=46090009 - Nov 2025 (56 comments)

A Note on Fil-C - https://news.ycombinator.com/item?id=45842494 - Nov 2025 (210 comments)

Fil-C: A memory-safe C implementation - https://news.ycombinator.com/item?id=45842242 - Nov 2025 (1 comment)

Notes by djb on using Fil-C - https://news.ycombinator.com/item?id=45788040 - Nov 2025 (246 comments)

for more, goto https://news.ycombinator.com/item?id=45792588

Claude Opus 5

Nvidia, Microsoft, Meta warn against overregulating open-weight models

Postgres LISTEN/NOTIFY actually scales

My security camera shipped a GitHub admin token in its login page

India's first privately-developed rocket reaches orbit on dramatic debut launch

Self-host your mail server

Fil-C: Garbage In, Memory Safety Out [video]

I got into YC by hacking it

Half-Life 2 running natively on HaikuOS

Don't Take the Black Pill [video]

Be skeptical of OpenAI's rogue hacker agent story

The hardest way to make a GIF

Gsxui – Shadcn-style components for Go

Extending Polars with Rust Expression Plugins

The front end framework for correctness: built on Effect, architected like Elm

DuckPGQ – A DuckDB community extension for graph workloads

The rise and fall of language diversity through the Holocene

It's getting harder to focus every day

Flux 3 X Mimic: The Next Generation of Video-Action Models

The small, real, original web

Flux 3

Unitree As2-W

JEP 541: Deprecate the macOS/x64 Port for Removal

Reporting Web 3D Capabilities on a Budget of $3 a Month

Em dashes are amazing

Codeberg Divides

Online Historical Encyclopaedia of Programming Languages

BGP ORIGIN attribute manipulation and its impact on the Internet

Latest Airbus single aisle aircraft innovations

Making Xen's dom0 I/O path NUMA aware

Fil-C: Garbage In, Memory Safety Out [video]

Comments

Claude Opus 5

Nvidia, Microsoft, Meta warn against overregulating open-weight models

Postgres LISTEN/NOTIFY actually scales

My security camera shipped a GitHub admin token in its login page

India's first privately-developed rocket reaches orbit on dramatic debut launch

Self-host your mail server

Fil-C: Garbage In, Memory Safety Out [video]

I got into YC by hacking it

Half-Life 2 running natively on HaikuOS

Don't Take the Black Pill [video]

Be skeptical of OpenAI's rogue hacker agent story

The hardest way to make a GIF

Gsxui – Shadcn-style components for Go

Extending Polars with Rust Expression Plugins

The front end framework for correctness: built on Effect, architected like Elm

DuckPGQ – A DuckDB community extension for graph workloads

The rise and fall of language diversity through the Holocene

It's getting harder to focus every day

Flux 3 X Mimic: The Next Generation of Video-Action Models

The small, real, original web

Flux 3

Unitree As2-W

JEP 541: Deprecate the macOS/x64 Port for Removal

Reporting Web 3D Capabilities on a Budget of $3 a Month

Em dashes are amazing

Codeberg Divides

Online Historical Encyclopaedia of Programming Languages

BGP ORIGIN attribute manipulation and its impact on the Internet

Latest Airbus single aisle aircraft innovations

Making Xen's dom0 I/O path NUMA aware