4 ms·

Probably getting downvoted because the assertion that modern C++ solves memory leaks is getting kind of tired as far as Rust discussions go, and is also missing

by Rusky 10y ago

Probably getting downvoted because the assertion that modern C++ solves memory leaks is getting kind of tired as far as Rust discussions go, and is also missing the point. Rust doesn't solve memory leaks, it solves memory unsafety- things like use-after-free and iterator invalidation that modern C++ does virtually nothing to help with, and that vulnerability statistics show are still huge problems with programs written in C++.

dbaupp 10y ago
I wrote something on the memory leak vs. memory unsafety confusion a while ago, for those interested in exploring it more: http://huonw.github.io/blog/2016/04/memory-leaks-are-memory-safe/ http://huonw.github.io/blog/2016/04/memory-leaks-are-memory-...
lossolo 10y ago
I don't see usage of new/free without encapsulation, this is not modern c++ which invalidates your point. Using naked new/free is depreciated in modern c++ and is problem of C not modern C++. What kind of statistics? Can you give any links that support what you wrote? All memory leaks/buffer overflows that i saw lately are associated with C (openssl, libc etc) not with C++. For iterator invalidation there are couple of simple rules to remember or for example you can use std::insert_iterator that will not be invalidated even if relocation occurs. You could use static analyzer and would avoid most of the problems. EDIT: My point is that i have nothing to gain from rust when knowing c++ and memory management rules + i got good static analyzer. But probably for someone that do not know C++ at all Rust could be a better choice.
- Rusky 10y ago
  Sticking the free in a destructor doesn't help you at all with memory safety, it just makes it easier to avoid leaks. Simple rules are, again according to the evidence, not good enough. There are simple rules you can follow in C as well. The benefit of Rust (as far as memory safety goes) is that the compiler enforces those rules. In fact, the mechanism by which it does this (lifetimes) is typically what makes Rust seem more complicated to beginners. But the fact is, that complication is still there in C and C++, the compiler just lets you deal with it all on your own.
  - lossolo 10y ago
    Yes i understand what your point is. I do not need to know/remember certain rules because compiler is doing this for me in Rust, my point is that if someone knows those rules in C++ and have good static analyzer he can get similar safety. I will try third time with Rust, i just feel sometimes like in shackles in Rust, i would like to say to compiler hey i know what i am doing, like i can do in C++.
    - pcwalton 10y ago
      > my point is that if someone knows those rules in C++ and have good static analyzer he can get similar safety. No. The entire history of large-scale security-critical applications in C++ disagrees with you. > I will try third time with Rust, i just feel sometimes like in shackles in Rust, i would like to say to compiler hey i know what i am doing, like i can do in C++. That's precisely what unsafe is for.
      - lossolo 10y ago
        Once again show me something that proves what you wrote, where is your history of modern C++ that proves that? No one provided any link.
        the_why_of_y 10y ago
        Here's Mozilla Firefox, search for "use-after-free", "memory safety hazard". https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/ https://www.mozilla.org/en-US/security/known-vulnerabilities... Here's Google Chrome, search for "buffer overflow", "Use after free", "out-of-bounds": http://googlechromereleases.blogspot.com/search/label/Stable%20updates http://googlechromereleases.blogspot.com/search/label/Stable... Edit: Chromium bug tracker talks to me now, query for "use-after-free" has 2157 results: https://bugs.chromium.org/p/chromium/issues/list?can=1&q=type%3Dbug-security+use-after-free&colspec=ID+Pri+M+Stars+ReleaseBlock+Component+Status+Owner+Summary+OS+Modified&x=m&y=releaseblock&cells=ids https://bugs.chromium.org/p/chromium/issues/list?can=1&q=typ...
- pcwalton 10y ago
  > What kind of statistics? Can you give any links that support what you wrote? Why yes, I can! https://bugzilla.mozilla.org/buglist.cgi?o5=substring&o13=substring&v26=free&v27=free&f26=status_whiteboard&v25=free&o14=substring&o16=substring&f13=component&o2=substring&f28=CP&f23=component&j11=OR&f29=CP&v5=use&o15=substring&f12=product&f25=short_desc&v24=free&o4=substring&f27=cf_crash_signature&o12=substring&f14=alias&o17=substring&f24=alias&v2=use&f21=OP&v13=after&v16=after&v4=use&f10=OP&f19=CP&v15=after&f22=product&f1=OP&o7=substring&v6=use&o3=substring&o26=substring&f20=OP&f8=CP&f0=OP&o25=substring&v3=use&o24=substring&f18=CP&j21=OR&f15=short_desc&o6=substring&f9=CP&v7=use&f4=alias&o23=substring&query_format=advanced&v23=free&j1=OR&f3=component&v17=after&f2=product&v12=after&f11=OP&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=RESOLVED&bug_status=VERIFIED&bug_status=CLOSED&f5=short_desc&f17=cf_crash_signature&o22=substring&v14=after&f6=status_whiteboard&f7=cf_crash_signature&v22=free&o27=substring&f16=status_whiteboard https://bugzilla.mozilla.org/buglist.cgi?o5=substring&o13=su... Before you object, this is largely modern C++. > You could use static analyzer and would avoid most of the problems. > EDIT: My point is that i have nothing to gain from rust when knowing c++ and memory management rules + i got good static analyzer. But probably for someone that do not know C++ at all Rust could be a better choice. Yes, you do. Empirically, programmers consistently make the same game-over mistakes in C++ over and over again.
  - lossolo 10y ago
    Every large code base in history of the world has bugs, doesn't matter which language. What you provided proves nothing. I don't know what kind of "programmers" you are talking about maybe some from mozilla (they are known for making same shitty mistakes over and over again, i will not mention exploits over the years in firefox, breach into unfixed bug/exploit internal system etc.) but i know programmers that can write good C++ without making any memory problems and Rust has nothing to offer for them. You are just biased.
    - the_why_of_y 10y ago
      Of course every large code base has bugs, that's why we should be very concerned about what the consequences of such bugs are for users. Please see my reply in the other sub-thread about very similar story of exploitable memory safety bugs in Google Chrome fixed in every release; do you want to continue your line of argument with a claim that Chromium developers are all incompetent too?

by Rusky 10y ago

dbaupp 10y ago

I wrote something on the memory leak vs. memory unsafety confusion a while ago, for those interested in exploring it more: http://huonw.github.io/blog/2016/04/memory-leaks-are-memory-safe/ http://huonw.github.io/blog/2016/04/memory-leaks-are-memory-...

lossolo 10y ago

I don't see usage of new/free without encapsulation, this is not modern c++ which invalidates your point. Using naked new/free is depreciated in modern c++ and is problem of C not modern C++. What kind of statistics? Can you give any links that support what you wrote? All memory leaks/buffer overflows that i saw lately are associated with C (openssl, libc etc) not with C++. For iterator invalidation there are couple of simple rules to remember or for example you can use std::insert_iterator that will not be invalidated even if relocation occurs. You could use static analyzer and would avoid most of the problems. EDIT: My point is that i have nothing to gain from rust when knowing c++ and memory management rules + i got good static analyzer. But probably for someone that do not know C++ at all Rust could be a better choice.

Rusky 10y ago
Sticking the free in a destructor doesn't help you at all with memory safety, it just makes it easier to avoid leaks. Simple rules are, again according to the evidence, not good enough. There are simple rules you can follow in C as well. The benefit of Rust (as far as memory safety goes) is that the compiler enforces those rules. In fact, the mechanism by which it does this (lifetimes) is typically what makes Rust seem more complicated to beginners. But the fact is, that complication is still there in C and C++, the compiler just lets you deal with it all on your own.
- lossolo 10y ago
  Yes i understand what your point is. I do not need to know/remember certain rules because compiler is doing this for me in Rust, my point is that if someone knows those rules in C++ and have good static analyzer he can get similar safety. I will try third time with Rust, i just feel sometimes like in shackles in Rust, i would like to say to compiler hey i know what i am doing, like i can do in C++.
  - pcwalton 10y ago
    > my point is that if someone knows those rules in C++ and have good static analyzer he can get similar safety. No. The entire history of large-scale security-critical applications in C++ disagrees with you. > I will try third time with Rust, i just feel sometimes like in shackles in Rust, i would like to say to compiler hey i know what i am doing, like i can do in C++. That's precisely what unsafe is for.
    - lossolo 10y ago
      Once again show me something that proves what you wrote, where is your history of modern C++ that proves that? No one provided any link.
      - the_why_of_y 10y ago
        Here's Mozilla Firefox, search for "use-after-free", "memory safety hazard". https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/ https://www.mozilla.org/en-US/security/known-vulnerabilities... Here's Google Chrome, search for "buffer overflow", "Use after free", "out-of-bounds": http://googlechromereleases.blogspot.com/search/label/Stable%20updates http://googlechromereleases.blogspot.com/search/label/Stable... Edit: Chromium bug tracker talks to me now, query for "use-after-free" has 2157 results: https://bugs.chromium.org/p/chromium/issues/list?can=1&q=type%3Dbug-security+use-after-free&colspec=ID+Pri+M+Stars+ReleaseBlock+Component+Status+Owner+Summary+OS+Modified&x=m&y=releaseblock&cells=ids https://bugs.chromium.org/p/chromium/issues/list?can=1&q=typ...
pcwalton 10y ago
> What kind of statistics? Can you give any links that support what you wrote? Why yes, I can! https://bugzilla.mozilla.org/buglist.cgi?o5=substring&o13=substring&v26=free&v27=free&f26=status_whiteboard&v25=free&o14=substring&o16=substring&f13=component&o2=substring&f28=CP&f23=component&j11=OR&f29=CP&v5=use&o15=substring&f12=product&f25=short_desc&v24=free&o4=substring&f27=cf_crash_signature&o12=substring&f14=alias&o17=substring&f24=alias&v2=use&f21=OP&v13=after&v16=after&v4=use&f10=OP&f19=CP&v15=after&f22=product&f1=OP&o7=substring&v6=use&o3=substring&o26=substring&f20=OP&f8=CP&f0=OP&o25=substring&v3=use&o24=substring&f18=CP&j21=OR&f15=short_desc&o6=substring&f9=CP&v7=use&f4=alias&o23=substring&query_format=advanced&v23=free&j1=OR&f3=component&v17=after&f2=product&v12=after&f11=OP&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=RESOLVED&bug_status=VERIFIED&bug_status=CLOSED&f5=short_desc&f17=cf_crash_signature&o22=substring&v14=after&f6=status_whiteboard&f7=cf_crash_signature&v22=free&o27=substring&f16=status_whiteboard https://bugzilla.mozilla.org/buglist.cgi?o5=substring&o13=su... Before you object, this is largely modern C++. > You could use static analyzer and would avoid most of the problems. > EDIT: My point is that i have nothing to gain from rust when knowing c++ and memory management rules + i got good static analyzer. But probably for someone that do not know C++ at all Rust could be a better choice. Yes, you do. Empirically, programmers consistently make the same game-over mistakes in C++ over and over again.
- lossolo 10y ago
  Every large code base in history of the world has bugs, doesn't matter which language. What you provided proves nothing. I don't know what kind of "programmers" you are talking about maybe some from mozilla (they are known for making same shitty mistakes over and over again, i will not mention exploits over the years in firefox, breach into unfixed bug/exploit internal system etc.) but i know programmers that can write good C++ without making any memory problems and Rust has nothing to offer for them. You are just biased.
  - the_why_of_y 10y ago
    Of course every large code base has bugs, that's why we should be very concerned about what the consequences of such bugs are for users. Please see my reply in the other sub-thread about very similar story of exploitable memory safety bugs in Google Chrome fixed in every release; do you want to continue your line of argument with a claim that Chromium developers are all incompetent too?