3 ms·

Please think carefully about what you're saying and try to avoid making unfounded generalizations about large groups of people ("C developers are picky" etc.)

Please think carefully about what you're saying and try to avoid making unfounded generalizations about large groups of people ("C developers are picky" etc.) People were willing to accept a lot of performance compromises to use C++. For example, C++ streams are at least 3x slower than stdio to this day. But they were still widely adopted. Similarly, exceptions caused a performance hit, but were widely used for a while. There isn't a single "modernist" style in C++, there are dozens of permutations (exceptions vs. no exceptions, boost vs. no boost, quasi-functional vs. C-like). I was a C++ developer for 10 years. More than half of the really difficult problems we encountered were C++-only, relating to constructs that didn't exist or were simpler in C. The reality is that C++ just has much more undefined behavior than C, which tends to make it less safe and less secure than that language. And some of the most exploitable software out there like Adobe Flash is written in the oh-so-safe C++ rather than the evil old C.

nickpsecurity 11y ago
"Please think carefully about what you're saying and try to avoid making unfounded generalizations about large groups of people ("C developers are picky" etc.) " I did. Over a decade of research, empirical comparisons, non-C-like alternatives to C, C-like alternatives to C, safer subsets of C... literally everything attempted failed to get a huge chunk of C people off C's problems. Even stuff that had most of C's advantages with less of its disadvantages. Tiniest tweaks didn't work. Whereas people on other languages and niches were more likely to experiment and try all kinds of languages for projects. So, I think it's clear the C crowd has some strong, emotional attachment to their language and way of thinking. So, to get adoption, C++ had to build on that nonsense we were trying to replace. It had to merge very contradictory philosophies. Without the C part, the job would've been easier. We know that's true because it was in a number of safe, system and application languages. Anything with C or C-style at foundation has problems.
- reality_czech 11y ago
  Think carefully about what you just wrote and ask yourself if you're being honest, or just shifting blame for your own failures on to "them." The people behind Objective C, Rust and Go aren't sitting on their hands because the oppression of "them." They're trying to make things better for authors of low-level software. The cult of shifting blame on to other people for C++'s failures needs to end. The language sucks. It's bad and you should feel bad. Period.
unscaled 11y ago
I agree with you that C++ streams are rather horrible. This is probably the oldest part of the standard library and the original design predated both templates and exceptions, so it had to do with virtual functions and error states. I wish we could have better library in the standard. If I needed performance, I would rather use a third party I/O library over stdio, which is a security nightmare. > There isn't a single "modernist" style in C++, there are dozens of permutations All complex languages have several styles, so it's not just a feature of C. Take a look at Scala (mutable vs immutable objects), Haskell (recursion vs. folding, lambdas vs. point-free) or even Javascript (callback-hell vs. promises vs. generators vs. async/await) and it's not so different than C++. If you want one style to rule them all, there's always Go. > More than half of the really difficult problems we encountered were C++-only, relating to constructs that didn't exist or were simpler in C. Yes, constructs like classes or templates don't exist in C, but their warts are generally born out of the requirement for C compatibility. Excruciating long compile time? Due to compatibility with C's preprocessor-based "module system". Private variables and methods have to appear in header files? Again, wouldn't be an issue if not for the mandated module system inherited from C. Weird template errors? Compatibility with C types made introducing constraints is quite hard (that's one of the reasons Concepts are languishing in the standards committee I guess). > And some of the most exploitable software out there like Adobe Flash is written in the oh-so-safe C++ rather than the evil old C. This software is more likely written in C with a sprinkle of C++ classes, lots of manual memory managements and, raw C arrays, C library calls and so on. My experience might not be representative enough, but the developers who tend to write this kind of malloc-happy code are the same developers who hate templates, exceptions and RAAI. You might as well call them C developers in a sheepskin.
- pjmlp 11y ago
  > I agree with you that C++ streams are rather horrible. Apparently I belong to that strange group of C++ devs that likes iostreams. :)
- reality_czech 11y ago
  I never said C++ streams were "horrible", just that they were slower than stdio and still got adopted. Which kind of negates the idea that among C++ "designers" (I use that term loosely) that you have to make all sorts of terrible semantic compromises to save a tiny bit of performance. I don't think stdio is "a security nightmare" either (I assume this canard is based on the fact that it still technically includes "gets" or some other such function that nobody has actually used in new code in 3 decades.) C++ is a uniquely schizophrenic language because you can't even use libraries developed in one style with code developed in another style. Try throwing an exception when -fno-exceptions is enabled in a google code base. Try passing code using a QString to code that wants a std::wstring. Tee hee. You can't say this about Javascript, Haskell, etc. and frankly your comparisons are vapid. And the C++ sheep keep bleating "it's C's fault, baaaaa" even after I gave the example of Objective C, which has modules and avoids C++ template hell. You even non-ironically blamed C for the C++ concepts feature "languishing in the standards committee." Can you not see that this is the equivalent of "thanks, Obama" whenever something goes wrong halfway across the world? What the hell does C have to do with templates or concepts? Yes, I'm sure evil C programmers are responsible for all crappy and insecure C++ software. They're in league with the Zionist media conspiracy to smear C++'s good name. We must root out these double agents wherever we find them! Onward C++ soldiers. Never question the decisions of your leaders, which are made for excellent reasons and always make complete sense.

nickpsecurity 11y ago

"Please think carefully about what you're saying and try to avoid making unfounded generalizations about large groups of people ("C developers are picky" etc.) " I did. Over a decade of research, empirical comparisons, non-C-like alternatives to C, C-like alternatives to C, safer subsets of C... literally everything attempted failed to get a huge chunk of C people off C's problems. Even stuff that had most of C's advantages with less of its disadvantages. Tiniest tweaks didn't work. Whereas people on other languages and niches were more likely to experiment and try all kinds of languages for projects. So, I think it's clear the C crowd has some strong, emotional attachment to their language and way of thinking. So, to get adoption, C++ had to build on that nonsense we were trying to replace. It had to merge very contradictory philosophies. Without the C part, the job would've been easier. We know that's true because it was in a number of safe, system and application languages. Anything with C or C-style at foundation has problems.

reality_czech 11y ago
Think carefully about what you just wrote and ask yourself if you're being honest, or just shifting blame for your own failures on to "them." The people behind Objective C, Rust and Go aren't sitting on their hands because the oppression of "them." They're trying to make things better for authors of low-level software. The cult of shifting blame on to other people for C++'s failures needs to end. The language sucks. It's bad and you should feel bad. Period.

unscaled 11y ago

I agree with you that C++ streams are rather horrible. This is probably the oldest part of the standard library and the original design predated both templates and exceptions, so it had to do with virtual functions and error states. I wish we could have better library in the standard. If I needed performance, I would rather use a third party I/O library over stdio, which is a security nightmare. > There isn't a single "modernist" style in C++, there are dozens of permutations All complex languages have several styles, so it's not just a feature of C. Take a look at Scala (mutable vs immutable objects), Haskell (recursion vs. folding, lambdas vs. point-free) or even Javascript (callback-hell vs. promises vs. generators vs. async/await) and it's not so different than C++. If you want one style to rule them all, there's always Go. > More than half of the really difficult problems we encountered were C++-only, relating to constructs that didn't exist or were simpler in C. Yes, constructs like classes or templates don't exist in C, but their warts are generally born out of the requirement for C compatibility. Excruciating long compile time? Due to compatibility with C's preprocessor-based "module system". Private variables and methods have to appear in header files? Again, wouldn't be an issue if not for the mandated module system inherited from C. Weird template errors? Compatibility with C types made introducing constraints is quite hard (that's one of the reasons Concepts are languishing in the standards committee I guess). > And some of the most exploitable software out there like Adobe Flash is written in the oh-so-safe C++ rather than the evil old C. This software is more likely written in C with a sprinkle of C++ classes, lots of manual memory managements and, raw C arrays, C library calls and so on. My experience might not be representative enough, but the developers who tend to write this kind of malloc-happy code are the same developers who hate templates, exceptions and RAAI. You might as well call them C developers in a sheepskin.

pjmlp 11y ago
> I agree with you that C++ streams are rather horrible. Apparently I belong to that strange group of C++ devs that likes iostreams. :)
reality_czech 11y ago
I never said C++ streams were "horrible", just that they were slower than stdio and still got adopted. Which kind of negates the idea that among C++ "designers" (I use that term loosely) that you have to make all sorts of terrible semantic compromises to save a tiny bit of performance. I don't think stdio is "a security nightmare" either (I assume this canard is based on the fact that it still technically includes "gets" or some other such function that nobody has actually used in new code in 3 decades.) C++ is a uniquely schizophrenic language because you can't even use libraries developed in one style with code developed in another style. Try throwing an exception when -fno-exceptions is enabled in a google code base. Try passing code using a QString to code that wants a std::wstring. Tee hee. You can't say this about Javascript, Haskell, etc. and frankly your comparisons are vapid. And the C++ sheep keep bleating "it's C's fault, baaaaa" even after I gave the example of Objective C, which has modules and avoids C++ template hell. You even non-ironically blamed C for the C++ concepts feature "languishing in the standards committee." Can you not see that this is the equivalent of "thanks, Obama" whenever something goes wrong halfway across the world? What the hell does C have to do with templates or concepts? Yes, I'm sure evil C programmers are responsible for all crappy and insecure C++ software. They're in league with the Zionist media conspiracy to smear C++'s good name. We must root out these double agents wherever we find them! Onward C++ soldiers. Never question the decisions of your leaders, which are made for excellent reasons and always make complete sense.