- Boost - lists.boost.org

Re: [boost] New Logo Discussion
by René Ferdinand Rivera Morell 18 Jul '24

18 Jul '24

On Wed, Jul 17, 2024 at 8:36 PM René Ferdinand Rivera Morell <grafikrobot(a)gmail.com> wrote: > > On Wed, Jul 17, 2024 at 6:50 PM Joel de Guzman via Boost > <boost(a)lists.boost.org> wrote: > > > > On 7/18/24 3:49 AM, René Ferdinand Rivera Morell via Boost wrote: > > > On Wed, Jul 17, 2024 at 2:42 PM Robert Ramey via Boost > > > <boost(a)lists.boost.org> wrote: > > >> On 7/17/24 11:59 AM, Vinnie Falco via Boost wrote: > > >>> Hi. It is CppCon 2024 season, and the C++ Alliance is working on letting > > >>> people know all the new and exciting things happening in Boost. We're doing > > >>> this with Boost labeled conference shirts, and a beautiful brochure. You > > >>> can see a draft of this promotional piece here (note: work in progress): > > >>> > > >>> https://cppalliance.org/pdf/Boost-Brochure-CppCon-2024.pdf > > >>> > > >> FWIW - I much prefer the current logo which was developed by community > > >> inclusive process with many submissions and designs. > > > It wasn't. The logo picked by the community in that process was never > > > used. What is currently used was the result of private design between > > > the Boost Steering Committee and the artist that "won" that logo > > > contest. > > > That is not correct. I was one of the major proponents of that logo contest (if not > > spearheded it). > > And I am not a member of the Boost Steering Committee. That contest was public and was > > discussed in the Boost list. It is NOT a private design. > > > > Here's part of the discussion (I do not have time to search all): > > https://lists.boost.org/Archives/boost//2005/03/81416.php > > > > You can see clearly I was asking for votes. > > I did not claim the logo contest was not community driven and resulted > in a community choice. I would know, as I submitted 11 designs in that > context. What I claimed is that the **current** logo was not chosen by > a community process. As the **current** logo was NOT the winning logo. > The winning logo (actually four) was a single, or trio, of stacked > cards (see attached). And as you can see it is very different from > what we have now. Trying this again because the attachment was too big. :-( See pair of individual images. -- -- René Ferdinand Rivera Morell -- Don't Assume Anything -- No Supone Nada -- Robot Dreams - http://robot-dreams.net

1 0

Where is Boost.Parser?
by Vinnie Falco 17 Jul '24

17 Jul '24

Boost.Parser was accepted on February 28th but it is not in the superproject, and the last commit in the source repository is from four months ago. I am developing a Boost brochure for CppCon 2024 and I'd like to go to press with Boost.Parser as a listed library, so this is a blocker. Thanks

3 5

Rephrased: Building Boost for MacOS / clang
by Stephen Greenfield 17 Jul '24

17 Jul '24

On Thu, 11 Jul 2024 Richard Hodges wrote: > This usually happens because you're compiling with one standard library > (e.g. libc++, the default on clang) while your boost libraries were > compiled with another (e.g. libstdc++, the default on gcc). I've recompiled my MacOS program for GCC (GNU C++17) and linked with libstdc++ to be compatible with the default build of Boost. Your suggestion WAS the solution to my reported slew of error messages. Thanks! QUESTION 1: But for building a standard MacOS or iPhone/iPad app, shouldn't I be building both my app and Boost for clang, so I can link with libc++? When I looked at the list of toolsets in the "getting started with unix variants", included with the 1_85_0 .zip package, there was no listing for toolset=clang or toolset=clang-darwin. Nor is there any mention of clang on: https://www.boost.org/doc/libs/1_85_0/more/getting_started/unix-variants.ht… QUESTION 2: So what is the proper toolset / build instructions to build for MacOS using the clang C++17 compiler? Stephen

1 0

A question for folks here
by David Sankel 16 Jul '24

16 Jul '24

For those who got involved in Boost within the last couple years, how did you hear about boost? What attracted you to it? For those who have been around for a while, what keeps you here? Why do you stay engaged?

16 25

[unordered] New natvis visualizations + accompanying article
by Braden Ganetsky 16 Jul '24

16 Jul '24

Hi everyone, This is my first message on the ML. I've written visualizations in the Visual Studio Natvis framework for the Boost.Unordered containers and iterators. This will improve the user experience for anyone using Visual Studio. The visualizations mirror those of the STL unordered containers as closely as possible, except that end iterators display as "{ end iterator }" instead of the visualization just breaking. Here is the file: https://github.com/boostorg/unordered/blob/develop/extra/boost_unordered.na… I've written an accompanying article about the natvis implementation for the closed-addressing containers. I will be writing a second article about the implementation for the open-addressing containers. This first article contains some tips and tricks for using the natvis framework that I wish I knew before going into this, especially about using "<Intrinsic>" elements. Hopefully it can help someone else. Link to the article: https://blog.ganets.ky/NatvisForUnordered/ Custom gdb pretty-printers will be next up. Thank you to Joaquín for reviewing the code and the article. Thanks all, Braden Ganetsky

2 2

Re: [boost] Boost Digest, Vol 7279, Issue 2
by Stephen Greenfield 15 Jul '24

15 Jul '24

BUMP / RE-SENT -- I think I got lost in a flurry of responses to another subject: Richard – > This usually happens because you're compiling with one standard library > (e.g. libc++, the default on clang) while your boost libraries were > compiled with another (e.g. libstdc++, the default on gcc). That makes sense. Does my MacOS program need to be compiled for GCC (IE GNU C++17 / GNU C++20), and then linked with libstdc++ to be compatible with the default build of Boost, or the opposite: build Boost and link with libc++? I saw that there's a list of toolsets, but in the "getting started with unix variants", included with the 1_85_0 .zip package, there is no listing for toolset=clang or toolset=clang-darwin. Nor is there any mention of clang on: https://www.boost.org/doc/libs/1_85_0/more/getting_started/unix-variants.ht… Stephen

1 0

Re: [boost] Boost Digest, Vol 7279, Issue 2
by Stephen Greenfield 11 Jul '24

11 Jul '24

Richard – > This usually happens because you're compiling with one standard library > (e.g. libc++, the default on clang) while your boost libraries were > compiled with another (e.g. libstdc++, the default on gcc). That makes sense. Does my MacOS program need to be compiled for GCC (IE GNU C++17 / GNU C++20), and then linked with libstdc++ to be compatible with the default build of Boost, or the opposite: build Boost and link with libc++? I saw that there’s a list of toolsets, but in the “getting started with unix variants”, included with the 1_85_0 .zip package, there is no listing for toolset=clang or toolset=clang-darwin. Nor is there any mention of clang on: https://www.boost.org/doc/libs/1_85_0/more/getting_started/unix-variants.ht… Stephen -- ------------------------------ Message: 5 Date: Thu, 11 Jul 2024 09:43:01 +0200 From: Richard Hodges <hodges.r(a)gmail.com> To: boost(a)lists.boost.org Subject: Re: [boost] Updating from 1_71_0 to 1_85_0: "No member named 'memcpy' in namespace 'std::__1'" Message-ID: <CALvx3haD3uRR4sXjjDq5Hrw4XoTq11HMqQyq2D5taJQzH7ys7A(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" This usually happens because you're compiling with one standard library (e.g. libc++, the default on clang) while your boost libraries were compiled with another (e.g. libstdc++, the default on gcc). R On Thu, 11 Jul 2024 at 02:21, Stephen Greenfield via Boost < boost(a)lists.boost.org> wrote: > Dear Boost gurus, > > Building on MacOS 12.7.3, Xcode 13.4.1, C++ dialect = C++17. Deployment > target is 10.15. This particular project is x86_64 architecture. I?m only > linking libboost_filesystem.a and libboost_iostreams.a (I show my build > boost build steps at the end). > > When updating from Boost 1_71_0 to 1_85_0, I?m suddenly encountering these > kinds of errors: > > > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/__functional/hash.h:40:5: > No member named 'memcpy' in namespace 'std::__1'; did you mean simply > 'memcpy'? > > > /Users/stephen/dev/Boost > Libraries/boost_1_85_0/boost/system/detail/append_int.hpp:23:5: No member > named 'snprintf' in namespace 'boost::system::detail'; did you mean simply > 'snprintf'? > > > > > In file included from > /Users/stephen/dev/Screenwriter/ScreenWriterX/ScreenWriterX/Screenwriter > Sources/Text Engine/CThingEdit.cp:22: > > In file included from ../ScreenWriterX/ScreenWriterX/Screenwriter > Sources/Text Engine/CThingEdit.h:61: > > In file included from > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/string:522: > > In file included from > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/algorithm:653: > > In file included from > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/functional:500: > > In file included from > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/__functional/function.h:20: > > In file included from > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/__memory/shared_ptr.h:25: > > In file included from > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/__memory/unique_ptr.h:15: > > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/__functional/hash.h:40:5: > error: no member named 'memcpy' in namespace 'std::__1'; did you mean > simply 'memcpy'? > > _VSTD::memcpy(&__r, __p, sizeof(__r)); > > ^~~~~~~ > > In file included from <built-in>:1: > > In file included from > /Users/stephen/dev/Screenwriter/ScreenWriterX/ScreenWriterX/Screenwriter > Sources/Screenwriter_Prefix.pch:505: > > In file included from > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/MacTypes.h:44: > > In file included from > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/stdbool.h:22: > > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/__config:858:15: > note: expanded from macro '_VSTD' > > #define _VSTD std::_LIBCPP_ABI_NAMESPACE > > ^ > > In file included from > /Users/stephen/dev/Screenwriter/ScreenWriterX/ScreenWriterX/Screenwriter > Sources/Text Engine/CThingEdit.cp:22: > > In file included from ../ScreenWriterX/ScreenWriterX/Screenwriter > Sources/Text Engine/CThingEdit.h:61: > > In file included from > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/string:522: > > In file included from > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/algorithm:652: > > /Users/stephen/dev/Boost > Libraries/boost_1_85_0/boost/compatibility/cpp_c_headers/cstring:22:11: > note: 'memcpy' declared here > > using ::memcpy; > > ^ > ?this is for all sorts of symbols. ALSO: > > > > > Showing All Errors Only > > /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/filesystem:2635:5: > Use of undeclared identifier '_LIBCPP_UNREACHABLE' > > > When including: > > #include <fstream> > > > The libraries were build using: > > ./bootstrap.sh cxxflags="-arch x86_64 -arch arm64" cflags="-arch x86_64 > -arch arm64" linkflags="-arch x86_64 -arch arm64" > > ./b2 toolset=clang-darwin target-os=darwin architecture=arm abi=aapcs > cxxflags="-arch arm64" cflags="-arch arm64" linkflags="-arch arm64" -a > > mkdir -p arm64 && cp stage/lib/*.* arm64 > > ./b2 toolset=clang-darwin target-os=darwin architecture=x86 > cxxflags="-arch x86_64" cflags="-arch x86_64" linkflags="-arch x86_64" > abi=sysv binary-format=mach-o -a > > mkdir x86_64 && cp stage/lib/*.* x86_64 > > The intention was for me to eventually make UNIVERSAL dylibs using lipo ? > but for now, I just want to get my build back to functioning with Boost > 1_85_0. > > NOTE that I?m continuing to use Boost?s Filesystem ? even though I THINK > Xcode?s C++20 might now support std::filesystem. > > I?ve searched all over for the answer ? even consulted ChatGPT ? but > haven?t found a solution. But this seems like something bone-headed I?ve > missed. > > Stephen > > _______________________________________________ > Unsubscribe & other changes: > http://lists.boost.org/mailman/listinfo.cgi/boost > ------------------------------ Subject: Digest Footer _______________________________________________ Unsubscribe & other changes: http://lists.boost.org/mailman/listinfo.cgi/boost ------------------------------ End of Boost Digest, Vol 7279, Issue 2 **************************************

1 0

Updating from 1_71_0 to 1_85_0: "No member named 'memcpy' in namespace 'std::__1'"
by Stephen Greenfield 11 Jul '24

11 Jul '24

Dear Boost gurus, Building on MacOS 12.7.3, Xcode 13.4.1, C++ dialect = C++17. Deployment target is 10.15. This particular project is x86_64 architecture. I’m only linking libboost_filesystem.a and libboost_iostreams.a (I show my build boost build steps at the end). When updating from Boost 1_71_0 to 1_85_0, I’m suddenly encountering these kinds of errors: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/__functional/hash.h:40:5: No member named 'memcpy' in namespace 'std::__1'; did you mean simply 'memcpy'? /Users/stephen/dev/Boost Libraries/boost_1_85_0/boost/system/detail/append_int.hpp:23:5: No member named 'snprintf' in namespace 'boost::system::detail'; did you mean simply 'snprintf'? In file included from /Users/stephen/dev/Screenwriter/ScreenWriterX/ScreenWriterX/Screenwriter Sources/Text Engine/CThingEdit.cp:22: In file included from ../ScreenWriterX/ScreenWriterX/Screenwriter Sources/Text Engine/CThingEdit.h:61: In file included from /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/string:522: In file included from /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/algorithm:653: In file included from /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/functional:500: In file included from /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/__functional/function.h:20: In file included from /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/__memory/shared_ptr.h:25: In file included from /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/__memory/unique_ptr.h:15: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/__functional/hash.h:40:5: error: no member named 'memcpy' in namespace 'std::__1'; did you mean simply 'memcpy'? _VSTD::memcpy(&__r, __p, sizeof(__r)); ^~~~~~~ In file included from <built-in>:1: In file included from /Users/stephen/dev/Screenwriter/ScreenWriterX/ScreenWriterX/Screenwriter Sources/Screenwriter_Prefix.pch:505: In file included from /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/MacTypes.h:44: In file included from /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/stdbool.h:22: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/__config:858:15: note: expanded from macro '_VSTD' #define _VSTD std::_LIBCPP_ABI_NAMESPACE ^ In file included from /Users/stephen/dev/Screenwriter/ScreenWriterX/ScreenWriterX/Screenwriter Sources/Text Engine/CThingEdit.cp:22: In file included from ../ScreenWriterX/ScreenWriterX/Screenwriter Sources/Text Engine/CThingEdit.h:61: In file included from /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/string:522: In file included from /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/algorithm:652: /Users/stephen/dev/Boost Libraries/boost_1_85_0/boost/compatibility/cpp_c_headers/cstring:22:11: note: 'memcpy' declared here using ::memcpy; ^ …this is for all sorts of symbols. ALSO: Showing All Errors Only /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk/usr/include/c++/v1/filesystem:2635:5: Use of undeclared identifier '_LIBCPP_UNREACHABLE' When including: #include <fstream> The libraries were build using: ./bootstrap.sh cxxflags="-arch x86_64 -arch arm64" cflags="-arch x86_64 -arch arm64" linkflags="-arch x86_64 -arch arm64" ./b2 toolset=clang-darwin target-os=darwin architecture=arm abi=aapcs cxxflags="-arch arm64" cflags="-arch arm64" linkflags="-arch arm64" -a mkdir -p arm64 && cp stage/lib/*.* arm64 ./b2 toolset=clang-darwin target-os=darwin architecture=x86 cxxflags="-arch x86_64" cflags="-arch x86_64" linkflags="-arch x86_64" abi=sysv binary-format=mach-o -a mkdir x86_64 && cp stage/lib/*.* x86_64 The intention was for me to eventually make UNIVERSAL dylibs using lipo – but for now, I just want to get my build back to functioning with Boost 1_85_0. NOTE that I’m continuing to use Boost’s Filesystem – even though I THINK Xcode’s C++20 might now support std::filesystem. I’ve searched all over for the answer – even consulted ChatGPT – but haven’t found a solution. But this seems like something bone-headed I’ve missed. Stephen

4 3

Re: [boost] A question for folks here
by me＠kennethreitz.org 11 Jul '24

11 Jul '24

Hi all, My name is Kenneth Reitz, and I got involved with Boost when Vinnie Falco asked me to join the C++ Alliance to work on the new boost website. You might recognize my name from the Python community, where I’m known for making Requests, Pipenv, and other tools. It’s nice to meet everyone! — Kenneth Reitz > 1. A question for folks here (David Sankel) > 2. Re: A secure string library? (Andrey Semashev) > 3. Re: A secure string library? (Andrey Semashev) > 4. Re: A question for folks here (Richard Hodges) > 5. Re: A secure string library? (Daniela Engert) > 6. Re: A secure string library? (Andrey Semashev) > 7. Re: A secure string library? (Christian Mazakas) > 8. Re: A question for folks here (Matt Borland) > 9. Re: A question for folks here (Christopher Kormanyos) > 10. Re: A question for folks here (Louis Tatta) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 10 Jul 2024 10:47:50 -0400 > From: David Sankel <camior(a)gmail.com> > To: Boost <boost(a)lists.boost.org> > Subject: [boost] A question for folks here > Message-ID: > <CAFYdOO+m95fKjxnKY3SY_eHC-X=PLs12BteaONG+QpS6fTCxcQ(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > For those who got involved in Boost within the last couple years, how did > you hear about boost? What attracted you to it? > > For those who have been around for a while, what keeps you here? Why do you > stay engaged? > > > ------------------------------ > > Message: 2 > Date: Wed, 10 Jul 2024 18:26:20 +0300 > From: Andrey Semashev <andrey.semashev(a)gmail.com> > To: boost(a)lists.boost.org > Subject: Re: [boost] A secure string library? > Message-ID: <6265cabd-c0b9-405e-98f4-8a47683e5472(a)gmail.com> > Content-Type: text/plain; charset=UTF-8 > > On 7/10/24 14:59, Peter Dimov via Boost wrote: >> Ruben Perez wrote: >>> There is OPENSSL_Cleanse, which does a similar job. I found it surprisingly >>> simple - I wonder if this is just enough or there are any corner cases where this >>> doesn't work: >>> https://github.com/openssl/openssl/blob/b544047c99c4a7413f793afe82ab1c165f8… >> >> That's an interesting approach. I can't offhand think of a reason why it wouldn't >> work. > > The compiler might convert OPENSSL_cleanse to something like this: > > void OPENSSL_cleanse(void *ptr, size_t len) > { > memset_t func = memset_func; > if (func != memset) > func(ptr, 0, len); > else > memset(ptr, 0, len); > } > > The purpose here is that, if memset_func is actually memset most of the > time, it can further optimize the call to memset, including to > completely remove it, depending on the call context. The > (well-predictable) branch is typically cheaper than an indirect call. I > think I've seen compilers do something along those lines as a result of > call devirtualization, especially with IPO and LTCG. > > I'm not saying that's what actually happens in OpenSSL, just that > something like this is possible. I think, a dummy asm statement is more > reliable and more efficient. > > void secure_cleanse(void *ptr, size_t len) > { > memset(ptr, 0, len); // a normal memset, optimizations are welcome > __asm__ __volatile__ ("" : : "r" (ptr), "r" (len) : "memory"); > } > > You can even make that function inline and it'll work, and in an optimal > way, too. > > > > ------------------------------ > > Message: 3 > Date: Wed, 10 Jul 2024 18:37:00 +0300 > From: Andrey Semashev <andrey.semashev(a)gmail.com> > To: boost(a)lists.boost.org > Subject: Re: [boost] A secure string library? > Message-ID: <57326885-13ab-4a73-ac5a-5aa6357e799c(a)gmail.com> > Content-Type: text/plain; charset=UTF-8 > > On 7/10/24 18:26, Andrey Semashev wrote: >> On 7/10/24 14:59, Peter Dimov via Boost wrote: >>> Ruben Perez wrote: >>>> There is OPENSSL_Cleanse, which does a similar job. I found it surprisingly >>>> simple - I wonder if this is just enough or there are any corner cases where this >>>> doesn't work: >>>> https://github.com/openssl/openssl/blob/b544047c99c4a7413f793afe82ab1c165f8… >>> >>> That's an interesting approach. I can't offhand think of a reason why it wouldn't >>> work. >> >> The compiler might convert OPENSSL_cleanse to something like this: >> >> void OPENSSL_cleanse(void *ptr, size_t len) >> { >> memset_t func = memset_func; >> if (func != memset) >> func(ptr, 0, len); >> else >> memset(ptr, 0, len); >> } >> >> The purpose here is that, if memset_func is actually memset most of the >> time, it can further optimize the call to memset, including to >> completely remove it, depending on the call context. The >> (well-predictable) branch is typically cheaper than an indirect call. I >> think I've seen compilers do something along those lines as a result of >> call devirtualization, especially with IPO and LTCG. >> >> I'm not saying that's what actually happens in OpenSSL, just that >> something like this is possible. I think, a dummy asm statement is more >> reliable and more efficient. >> >> void secure_cleanse(void *ptr, size_t len) >> { >> memset(ptr, 0, len); // a normal memset, optimizations are welcome >> __asm__ __volatile__ ("" : : "r" (ptr), "r" (len) : "memory"); >> } >> >> You can even make that function inline and it'll work, and in an optimal >> way, too. > > And for compilers that don't support __asm__, I think you could replace > it with: > > std::atomic_signal_fence(std::memory_order::acq_rel); > > > > ------------------------------ > > Message: 4 > Date: Wed, 10 Jul 2024 18:01:03 +0200 > From: Richard Hodges <hodges.r(a)gmail.com> > To: boost(a)lists.boost.org > Subject: Re: [boost] A question for folks here > Message-ID: > <CALvx3hYSO6svxz_aEw_LoaraweTguqW+jJScTyfymZAveOrXZg(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > On Wed, 10 Jul 2024 at 16:48, David Sankel via Boost <boost(a)lists.boost.org> > wrote: > >> For those who got involved in Boost within the last couple years, how did >> you hear about boost? What attracted you to it? >> > > I've been using boost as an essential force multiplier of C++ since version > 1.35 when Asio appeared, courtesy of Chris Kohlhoff. > > More recently in 2017, I needed an asynchronous websocket library for C++ > and lo-and-behold, boost had one, courtesy of Vinnie Falco. > > >> >> For those who have been around for a while, what keeps you here? Why do you >> stay engaged? >> > > After finishing a contract in which I used Boost.Beast et.al. in production > code, I took up an offer by the C++ Alliance to become a maintainer of it. > A bit of a "Victor Kiam" moment, if you will. > > While working for the C++ Alliance I was also involved in the design and > first cut of Boost.Json and had some input into Boost.Url, another two very > keenly needed libraries sponsored by the C++ Alliance. > I am no longer working for the C++ Alliance, but maintain a warm > relationship with the organisation. > > I am currently using Boost.Cobalt in a financial trading software suite. > > I stay engaged because: > - I don't want to have to switch languages - C++ is perfectly fine for me. > - Boost polyfills all the essential functionality that the children running > WG21 continue to refuse to provide. > - It's convenient to have one library that provides (almost) every tool I > need. > > My very great thanks to the original authors and contributors, and more > recently to the C++ Alliance, which as far as I can see is the only major > sponsor of Boost. > Without this organisation's involvement, I believe the libraries would have > been allowed to fall into disrepair a long time ago. > > I don't think I have met more than one team in the financial industry which > uses C++ but which does not use Boost. > > On a separate note, I was deeply disappointed by your recent public > outbursts, David. > > Sincerely, > > Richard Hodges > A C++phile > ex maintainer of Boost.Beast > contributor to Boost.Json, Boost.Url > Advisor to Boost.MySQL, Boost.Cobalt > > >> >> _______________________________________________ >> Unsubscribe & other changes: >> http://lists.boost.org/mailman/listinfo.cgi/boost >> > > > ------------------------------ > > Message: 5 > Date: Wed, 10 Jul 2024 18:13:41 +0200 > From: Daniela Engert <dani(a)ngrt.de> > To: boost(a)lists.boost.org > Subject: Re: [boost] A secure string library? > Message-ID: <98140e71-ef1e-431a-a089-e24f56e390bd(a)ngrt.de> > Content-Type: text/plain; charset=UTF-8; format=flowed > > Am 10.07.2024 um 17:37 schrieb Andrey Semashev via Boost: >> On 7/10/24 18:26, Andrey Semashev wrote: >>> On 7/10/24 14:59, Peter Dimov via Boost wrote: >>>> Ruben Perez wrote: >>>>> There is OPENSSL_Cleanse, which does a similar job. I found it surprisingly >>>>> simple - I wonder if this is just enough or there are any corner cases where this >>>>> doesn't work: >>>>> https://github.com/openssl/openssl/blob/b544047c99c4a7413f793afe82ab1c165f8… >>>> That's an interesting approach. I can't offhand think of a reason why it wouldn't >>>> work. >>> The compiler might convert OPENSSL_cleanse to something like this: >>> >>> void OPENSSL_cleanse(void *ptr, size_t len) >>> { >>> memset_t func = memset_func; >>> if (func != memset) >>> func(ptr, 0, len); >>> else >>> memset(ptr, 0, len); >>> } >>> >>> The purpose here is that, if memset_func is actually memset most of the >>> time, it can further optimize the call to memset, including to >>> completely remove it, depending on the call context. The >>> (well-predictable) branch is typically cheaper than an indirect call. I >>> think I've seen compilers do something along those lines as a result of >>> call devirtualization, especially with IPO and LTCG. >>> >>> I'm not saying that's what actually happens in OpenSSL, just that >>> something like this is possible. I think, a dummy asm statement is more >>> reliable and more efficient. >>> >>> void secure_cleanse(void *ptr, size_t len) >>> { >>> memset(ptr, 0, len); // a normal memset, optimizations are welcome >>> __asm__ __volatile__ ("" : : "r" (ptr), "r" (len) : "memory"); >>> } >>> >>> You can even make that function inline and it'll work, and in an optimal >>> way, too. >> And for compilers that don't support __asm__, I think you could replace >> it with: >> >> std::atomic_signal_fence(std::memory_order::acq_rel); >> > I think Peter is actually right in his assessment: > > While 'memset_func' is TU-local, it is also 'volatile'. This implies > every look at it might reveal a different content. Therefore the > necessity for non-constness and dynamic initialization. We humans see > that the variable can't change its value other than in the > initialization. The compiler can't reason that because said properties > are the only ones known during the compilation of 'OPENSSL_cleanse()'. > It can't perform unbounded look-ahead until the end of the TU like we do. > > Dani > > -- > PGP/GPG: 2CCB 3ECB 0954 5CD3 B0DB 6AA0 BA03 56A1 2C4638C5 > > ------------------------------ > > Message: 6 > Date: Wed, 10 Jul 2024 19:24:48 +0300 > From: Andrey Semashev <andrey.semashev(a)gmail.com> > To: boost(a)lists.boost.org > Subject: Re: [boost] A secure string library? > Message-ID: <905dd5f7-5d29-48ab-87aa-6aa0a23e60c6(a)gmail.com> > Content-Type: text/plain; charset=UTF-8 > > On 7/10/24 19:13, Daniela Engert via Boost wrote: >> Am 10.07.2024 um 17:37 schrieb Andrey Semashev via Boost: >>> On 7/10/24 18:26, Andrey Semashev wrote: >>>> On 7/10/24 14:59, Peter Dimov via Boost wrote: >>>>> Ruben Perez wrote: >>>>>> There is OPENSSL_Cleanse, which does a similar job. I found it >>>>>> surprisingly >>>>>> simple - I wonder if this is just enough or there are any corner >>>>>> cases where this >>>>>> doesn't work: >>>>>> https://github.com/openssl/openssl/blob/b544047c99c4a7413f793afe82ab1c165f8… >>>>> That's an interesting approach. I can't offhand think of a reason >>>>> why it wouldn't >>>>> work. >>>> The compiler might convert OPENSSL_cleanse to something like this: >>>> >>>> ?? void OPENSSL_cleanse(void *ptr, size_t len) >>>> ?? { >>>> ???? memset_t func = memset_func; >>>> ???? if (func != memset) >>>> ?????? func(ptr, 0, len); >>>> ???? else >>>> ?????? memset(ptr, 0, len); >>>> ?? } >>>> >>>> The purpose here is that, if memset_func is actually memset most of the >>>> time, it can further optimize the call to memset, including to >>>> completely remove it, depending on the call context. The >>>> (well-predictable) branch is typically cheaper than an indirect call. I >>>> think I've seen compilers do something along those lines as a result of >>>> call devirtualization, especially with IPO and LTCG. >>>> >>>> I'm not saying that's what actually happens in OpenSSL, just that >>>> something like this is possible. I think, a dummy asm statement is more >>>> reliable and more efficient. >>>> >>>> ?? void secure_cleanse(void *ptr, size_t len) >>>> ?? { >>>> ???? memset(ptr, 0, len); // a normal memset, optimizations are welcome >>>> ???? __asm__ __volatile__ ("" : : "r" (ptr), "r" (len) : "memory"); >>>> ?? } >>>> >>>> You can even make that function inline and it'll work, and in an optimal >>>> way, too. >>> And for compilers that don't support __asm__, I think you could replace >>> it with: >>> >>> ?? std::atomic_signal_fence(std::memory_order::acq_rel); >>> >> I think Peter is actually right in his assessment: >> >> While 'memset_func' is TU-local, it is also 'volatile'. This implies >> every look at it might reveal a different content. Therefore the >> necessity for non-constness and dynamic initialization. We humans see >> that the variable can't change its value other than in the >> initialization. The compiler can't reason that because said properties >> are the only ones known during the compilation of 'OPENSSL_cleanse()'. >> It can't perform unbounded look-ahead until the end of the TU like we do. > > With volatile, the compiler is not allowed to optimize away or reorder > loads and stores of the variable. There's no restriction on what the > compiler is allowed to do with the loaded value. > > > > ------------------------------ > > Message: 7 > Date: Wed, 10 Jul 2024 10:10:43 -0700 > From: Christian Mazakas <christian.mazakas(a)gmail.com> > To: boost(a)lists.boost.org > Subject: Re: [boost] A secure string library? > Message-ID: > <CAHf7xWueD5=ekMC178pikzH2iuhAtyzC6v5UgPBSoj0NMy3y9Q(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > >> Andrey Semashev via Boost: >> With volatile, the compiler is not allowed to optimize away or reorder >> loads and stores of the variable. There's no restriction on what the >> compiler is allowed to do with the loaded value. > > It could insert a branch against `memset` but that seems really only like a > theoretical > optimization. > > This is an example where the volatile preserves the secure_erase() call: > https://godbolt.org/z/854jfarb9 > > Kind of neat trying to get the compiler to elide this stuff. You were > right, Andrey, you really need > LTO and LTCG and the like to get this kind of behavior. Super neat stuff. > > Idk, seems like whatever OpenSSL is doing is Sound Enough in practice. > > I'd be curious to know if it's actually sound for a compiler to make that > kind of optimization or at least > what are the limits on how far a compiler can actually go to ensure > soundness. If you know those limits, > you can probably make this pattern work reliably. > > - Christian > > > ------------------------------ > > Message: 8 > Date: Wed, 10 Jul 2024 17:57:57 +0000 > From: Matt Borland <matt(a)mattborland.com> > To: boost(a)lists.boost.org > Subject: Re: [boost] A question for folks here > Message-ID: > <LQ-gmVceAUPyCRzsmP5gN1Z4NJiwrRtJ-yJY5Q6Ne-3SnJ_omC84hltKP9AbS3x-TVlz35Amln3jW0CBdG0nnzAioM53fxXobq0GO3zYb2E=(a)mattborland.com> > > Content-Type: text/plain; charset="utf-8" > > >> For those who got involved in Boost within the last couple years, how did >> you hear about boost? > > I heard about it from a university professor as a freshman undergraduate student in 2011. Since C++11 was just coming about, and the speed of updating toolchains in academia is slow so we were stuck in the C++03 days on old RHEL systems. > >> What attracted you to it? > > I was studying aeronautical engineering so having pre-made libraries like Boost.Math, Boost.Multiprecision, and ODEint were useful to me. I could focus on the problem at hand rather than having to roll my own special functions, solvers, big numbers, constants, etc. > >> For those who have been around for a while, what keeps you here? Why do you stay engaged? > > I started to get involved with development during the COVID lockdowns because like many people I found myself with quite a bit of extra free time. What hooked me was learning from and working with extremely competent programmers and mathematicians like John Maddock, Chris Kormanyos, and Nick Thompson. I was hired by the C++ Alliance at the beginning of 2023 and they have sponsored my development since. This allows me to work on new (https://github.com/cppalliance/decimal) and existing libraries (charconv, math, multiprecision, random, etc) in a way that I was never able to on a volunteer basis with a full time job. The community is large, knowledgeable, and helpful so I continue to enjoy working on Boost. > > > I think it would be beneficial to the developer community for the Boost Foundation board members to also answer these questions. Frankly some even require introductions with their answers. There are members of the board like Peter, Glen, and Zach that are Titans of Boost, and those like Kristen who I had not heard of until her post about wanting to cut ties with the C++ Alliance. Having unknown members of the Boost Foundation runs counter to their mission statement whereby the board intends to achieve its mission by "fostering community engagement, [and] nurturing leaders..."[1]. > > Matt > > [1] https://sites.google.com/boost.org/boost-foundation/home >

2 1

A secure string library?
by Ruben Perez 10 Jul '24

10 Jul '24

Hi all, Boost.MySQL and Boost.Redis need to hold sensitive information, like passwords, to work. Using std::string may be sufficient for many use cases, but it's not the best security practice. std::string doesn't wipe its memory on cleanup, resulting in the password remaining in memory for an indeterminate amount of time. Other languages like C# implement a SecureString class that wipes memory on destruction. Crypto++ implements a similar concept, but it's a big dependency I'm not willing to take. I'd like to know whether everyone else's opinion on this: * Have you faced this issue before? * Do you think this is something we (as Boost authors) should care about, or am I thinking too much? * Do you think a library implementing secure string/array/buffer classes would be a valuable addition to Boost? Thanks, Ruben.

11 22