3 ms·

Sticking the free in a destructor doesn't help you at all with memory safety, it just makes it easier to avoid leaks. Simple rules are, again according to the

by Rusky 10y ago

Sticking the free in a destructor doesn't help you at all with memory safety, it just makes it easier to avoid leaks. Simple rules are, again according to the evidence, not good enough. There are simple rules you can follow in C as well. The benefit of Rust (as far as memory safety goes) is that the compiler enforces those rules. In fact, the mechanism by which it does this (lifetimes) is typically what makes Rust seem more complicated to beginners. But the fact is, that complication is still there in C and C++, the compiler just lets you deal with it all on your own.

lossolo 10y ago
Yes i understand what your point is. I do not need to know/remember certain rules because compiler is doing this for me in Rust, my point is that if someone knows those rules in C++ and have good static analyzer he can get similar safety. I will try third time with Rust, i just feel sometimes like in shackles in Rust, i would like to say to compiler hey i know what i am doing, like i can do in C++.
- pcwalton 10y ago
  > my point is that if someone knows those rules in C++ and have good static analyzer he can get similar safety. No. The entire history of large-scale security-critical applications in C++ disagrees with you. > I will try third time with Rust, i just feel sometimes like in shackles in Rust, i would like to say to compiler hey i know what i am doing, like i can do in C++. That's precisely what unsafe is for.
  - lossolo 10y ago
    Once again show me something that proves what you wrote, where is your history of modern C++ that proves that? No one provided any link.
    - the_why_of_y 10y ago
      Here's Mozilla Firefox, search for "use-after-free", "memory safety hazard". https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/ https://www.mozilla.org/en-US/security/known-vulnerabilities... Here's Google Chrome, search for "buffer overflow", "Use after free", "out-of-bounds": http://googlechromereleases.blogspot.com/search/label/Stable%20updates http://googlechromereleases.blogspot.com/search/label/Stable... Edit: Chromium bug tracker talks to me now, query for "use-after-free" has 2157 results: https://bugs.chromium.org/p/chromium/issues/list?can=1&q=type%3Dbug-security+use-after-free&colspec=ID+Pri+M+Stars+ReleaseBlock+Component+Status+Owner+Summary+OS+Modified&x=m&y=releaseblock&cells=ids https://bugs.chromium.org/p/chromium/issues/list?can=1&q=typ...
      - lossolo 10y ago
        Once again, show me ONLY modern c++ code base. Those are mixed with old C++ code base. Still waiting. And read how chromium use C++11... (https://chromium-cpp.appspot.com/ https://chromium-cpp.appspot.com/) + google style guide that is prehistory and NOT considered good in community. Maybe try with proxygen, rocksdb, folly from facebook ?
        pcwalton 10y ago
        > Once again, show me ONLY modern c++ code base. Those are mixed with old C++ code base. These security flaws are in code that has used smart pointers for years and years. > And read how chromium use C++11... (https://chromium-cpp.appspot.com/ https://chromium-cpp.appspot.com/) + google style guide that is prehistory and NOT considered good in community. It doesn't matter from a security perspective. In fact, I think C++11 is actually less safe than C++03 with custom smart pointers, because use-after-move is a hazard and lambdas make it very easy to have dangling references. Chromium security engineers are some of the most competent engineers in their field. If using more C++11 features made their code more secure, they would do so. They don't, because C++11 doesn't make their code more secure. Ultimately, these debates are really premised on something absurd: "assume modern C++ is completely memory safe unless proved otherwise". This is completely backwards and leads to endless "no true Scotsman" games. You need to show why C++ is supposedly memory safe. You won't be able to, because C++ is not. > Maybe try with proxygen, rocksdb, folly from facebook ? Those codebases aren't being attacked the same way browsers are. But I can easily find use-after-free in them too with Google: http://code.metager.de/source/history/facebook/folly/folly/io/async/test/DelayedDestructionBaseTest.cpp http://code.metager.de/source/history/facebook/folly/folly/i...

by Rusky 10y ago

lossolo 10y ago

Yes i understand what your point is. I do not need to know/remember certain rules because compiler is doing this for me in Rust, my point is that if someone knows those rules in C++ and have good static analyzer he can get similar safety. I will try third time with Rust, i just feel sometimes like in shackles in Rust, i would like to say to compiler hey i know what i am doing, like i can do in C++.

pcwalton 10y ago
> my point is that if someone knows those rules in C++ and have good static analyzer he can get similar safety. No. The entire history of large-scale security-critical applications in C++ disagrees with you. > I will try third time with Rust, i just feel sometimes like in shackles in Rust, i would like to say to compiler hey i know what i am doing, like i can do in C++. That's precisely what unsafe is for.
- lossolo 10y ago
  Once again show me something that proves what you wrote, where is your history of modern C++ that proves that? No one provided any link.
  - the_why_of_y 10y ago
    Here's Mozilla Firefox, search for "use-after-free", "memory safety hazard". https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/ https://www.mozilla.org/en-US/security/known-vulnerabilities... Here's Google Chrome, search for "buffer overflow", "Use after free", "out-of-bounds": http://googlechromereleases.blogspot.com/search/label/Stable%20updates http://googlechromereleases.blogspot.com/search/label/Stable... Edit: Chromium bug tracker talks to me now, query for "use-after-free" has 2157 results: https://bugs.chromium.org/p/chromium/issues/list?can=1&q=type%3Dbug-security+use-after-free&colspec=ID+Pri+M+Stars+ReleaseBlock+Component+Status+Owner+Summary+OS+Modified&x=m&y=releaseblock&cells=ids https://bugs.chromium.org/p/chromium/issues/list?can=1&q=typ...
    - lossolo 10y ago
      Once again, show me ONLY modern c++ code base. Those are mixed with old C++ code base. Still waiting. And read how chromium use C++11... (https://chromium-cpp.appspot.com/ https://chromium-cpp.appspot.com/) + google style guide that is prehistory and NOT considered good in community. Maybe try with proxygen, rocksdb, folly from facebook ?
      - pcwalton 10y ago
        > Once again, show me ONLY modern c++ code base. Those are mixed with old C++ code base. These security flaws are in code that has used smart pointers for years and years. > And read how chromium use C++11... (https://chromium-cpp.appspot.com/ https://chromium-cpp.appspot.com/) + google style guide that is prehistory and NOT considered good in community. It doesn't matter from a security perspective. In fact, I think C++11 is actually less safe than C++03 with custom smart pointers, because use-after-move is a hazard and lambdas make it very easy to have dangling references. Chromium security engineers are some of the most competent engineers in their field. If using more C++11 features made their code more secure, they would do so. They don't, because C++11 doesn't make their code more secure. Ultimately, these debates are really premised on something absurd: "assume modern C++ is completely memory safe unless proved otherwise". This is completely backwards and leads to endless "no true Scotsman" games. You need to show why C++ is supposedly memory safe. You won't be able to, because C++ is not. > Maybe try with proxygen, rocksdb, folly from facebook ? Those codebases aren't being attacked the same way browsers are. But I can easily find use-after-free in them too with Google: http://code.metager.de/source/history/facebook/folly/folly/io/async/test/DelayedDestructionBaseTest.cpp http://code.metager.de/source/history/facebook/folly/folly/i...