4 ms·

With regard to speed and pure portability, neither are comparable to C++. Also, C++ is not a corporate controlled language like the others. It's an ISO standard

by w8rbt 11y ago

With regard to speed and pure portability, neither are comparable to C++. Also, C++ is not a corporate controlled language like the others. It's an ISO standard. So there's no comparison to be made there either. Corporate controlled languages do not allow developers to fully control the software that they produce. C++ allows this and it's very fast and safe (even safer since C++11). Microsoft has C#. Google has Go. Apple has Swift. Oracle has Java. Which would you want to lock your software into? Also, most all of those languages (or at least the critical parts) are implemented in C++ (hotspot).

pcwalton 11y ago
> C++ allows this and it's very fast and safe (even safer since C++11). The security track records of large-scale security-sensitive software written in C++ support the opposite conclusion. > Also, most all of those languages (or at least the critical parts) are implemented in C++ (hotspot). Go is not, and never was, implemented in C++.
- d0lph 11y ago
  Are you sure you're not thinking of C? At any rate I'm not sure that you can say much more than C is a popular language, and thus has a larger share of poorly written code. It _would_ be nice to see the number of security flaws in a given language graphed against language popularity, but I don't buy that code written in one language or another is necessarily more or less secure.
  - pcwalton 11y ago
    > Are you sure you're not thinking of C? Yes. Modern C++ is neither memory safe in theory nor memory safe in practice. > I don't buy that code written in one language or another is necessarily more or less secure. The entire security industry, more or less, disagrees with you. Though I should qualify this with the obvious statements that (a) dynamic languages admit classes of security bugs that static ones don't; (b) no language will magically eliminate all security bugs. But it's just an empirical fact that C and C++ admit lots of memory safety bugs that result in security problems way, way more often than memory-safe languages do.
- iofj 11y ago
  So does the security track record of large-scale java software ... The only conclusion I've ever really drawn from software analysis is that large scale software written by armies of programmers is full of security problems. As soon as the organisation stops investing in being the one that knows the most about the security problems of their own software ... shit hits the fan. Since security tends to be one of the first things to get "financially optimized" ... Go is (less and less over time but still not 0%) implemented in C, with macros. Let's not pretend this is an improvement over C++, because it isn't. The only advantage C has over C++ is that most C programs are far smaller than most C++ programs (on average, of course, there are exceptions). Oh, and if you think C++'s security track record is bad, you will find C's track record horrendous.

by w8rbt 11y ago

pcwalton 11y ago

> C++ allows this and it's very fast and safe (even safer since C++11). The security track records of large-scale security-sensitive software written in C++ support the opposite conclusion. > Also, most all of those languages (or at least the critical parts) are implemented in C++ (hotspot). Go is not, and never was, implemented in C++.

d0lph 11y ago
Are you sure you're not thinking of C? At any rate I'm not sure that you can say much more than C is a popular language, and thus has a larger share of poorly written code. It _would_ be nice to see the number of security flaws in a given language graphed against language popularity, but I don't buy that code written in one language or another is necessarily more or less secure.
- pcwalton 11y ago
  > Are you sure you're not thinking of C? Yes. Modern C++ is neither memory safe in theory nor memory safe in practice. > I don't buy that code written in one language or another is necessarily more or less secure. The entire security industry, more or less, disagrees with you. Though I should qualify this with the obvious statements that (a) dynamic languages admit classes of security bugs that static ones don't; (b) no language will magically eliminate all security bugs. But it's just an empirical fact that C and C++ admit lots of memory safety bugs that result in security problems way, way more often than memory-safe languages do.
iofj 11y ago
So does the security track record of large-scale java software ... The only conclusion I've ever really drawn from software analysis is that large scale software written by armies of programmers is full of security problems. As soon as the organisation stops investing in being the one that knows the most about the security problems of their own software ... shit hits the fan. Since security tends to be one of the first things to get "financially optimized" ... Go is (less and less over time but still not 0%) implemented in C, with macros. Let's not pretend this is an improvement over C++, because it isn't. The only advantage C has over C++ is that most C programs are far smaller than most C++ programs (on average, of course, there are exceptions). Oh, and if you think C++'s security track record is bad, you will find C's track record horrendous.