Quotes of the week

Either you write in an incredibly restricted subset of C that is totally infeasible for something like the Linux kernel, or you write in a larger subset of C with annotations to help the static analyzer/verifier prove absence of classes of bugs. The problem with the latter approach is that even though a C compiler might compile your code, you're not really writing C anymore, you're writing a superset of a subset of C that everyone other than the C compiler needs to understand. And is twisting the syntax and semantics of your language so that a C compiler can compile it really worthwhile, or should you take the opportunity to fix some of the bad C decisions?

It's possible that creating your own language that's a bit like Rust but looks more like C unlocks some incrementality benefits for Linux (while having some pretty major costss). It's hard to tell without doing experiments.