3 ms·

Please, reread carefully your initial comment and the one by prodigal_erik (the two comments I've answered to in this thread) and you will see that you've made

by narag 11y ago

Please, reread carefully your initial comment and the one by prodigal_erik (the two comments I've answered to in this thread) and you will see that you've made a gross generalization, while now you're narrowing the field you meant to apply your words. Do you believe that security software or browsers are better writen in other languages than C/C++? I won't dispute that, even if I'd have some questions about relative merits. Please think of some well known Perl and PHP applications and their security record. Anyway the unqualified: That's because correct C-style memory management never† scales up to large software projects in a way that doesn't result in crashes and, worse, vulnerabilities. ... and talking about manual memory management in general... And pretty much all of them are unreliable garbage that we as an industry should have been too embarrassed to ship. ... are simply not true. Worse, they're insulting for everyone who has worked in this kind of application.

pcwalton 11y ago
> Do you believe that security software or browsers are better writen in other languages than C/C++? Yes. And lots and lots of apps (most public network facing things) are security sensitive. > Please think of some well known Perl and PHP applications and their security record. Nobody is saying that "memory safe == no vulnerabilities". I do think it's true that being memory unsafe results in many more vulnerabilities. I've measured this precise statistic in our bug tracker. > That's because correct C-style memory management never† scales up to large software projects in a way that doesn't result in crashes and, worse, vulnerabilities. It's true. And I work in native code myself! It's only an insult if you presuppose that introducing vulnerabilities reflects badly on the programmer who introduced them. I don't believe that; most major vulnerabilities I've seen were introduced by very good programmers. It's a problem with the tools they're working with.

by narag 11y ago

pcwalton 11y ago

> Do you believe that security software or browsers are better writen in other languages than C/C++? Yes. And lots and lots of apps (most public network facing things) are security sensitive. > Please think of some well known Perl and PHP applications and their security record. Nobody is saying that "memory safe == no vulnerabilities". I do think it's true that being memory unsafe results in many more vulnerabilities. I've measured this precise statistic in our bug tracker. > That's because correct C-style memory management never† scales up to large software projects in a way that doesn't result in crashes and, worse, vulnerabilities. It's true. And I work in native code myself! It's only an insult if you presuppose that introducing vulnerabilities reflects badly on the programmer who introduced them. I don't believe that; most major vulnerabilities I've seen were introduced by very good programmers. It's a problem with the tools they're working with.