3 ms·
No one is arguing that the industry moving to a safer language will reduce the level of nasty bugs in the world. That would be silly to argue against, because t
by jjnoakes 10y ago
No one is arguing that the industry moving to a safer language will reduce the level of nasty bugs in the world. That would be silly to argue against, because that's basically a tautology anyway.
What I'm disputing is that no teams write good C or C++ code.
In fact, the 1% who raised their hands proves my point. It isn't 0%.
That's all I'm saying. Don't smear our names with the "all C and C++ developers write code with exploitable undefined behavior bugs in it" when you mean "most C and C++ developers write code with exploitable undefined behavior bugs in it".
- pjmlp 10y agoC++ is my language to go, every time I need to go out of JVM and .NET ecosystems and I do take all efforts to be part of that 1%. Once upon a time I gave C++ class to first year students at the university where I took my degree. Worked with C++ at some well known companies and research institutions. Still, I won't say I never write exploitable undefined behaviour free code in C++, let alone C. Because I cannot control the code that gets used by third party libraries, written by team members or even having the whole UB use cases on my head.
- jjnoakes 10y agoIf you use the right tools (static analysis and sanitizers and fuzzers) your own code (and any code you rely on which you have the source for) will be handled. If you rely on binary dependencies which have quality problems, then u can't help you there. But that could be an attack vector in any language. And if you are worried about the operating system itself, then there really is no easy way around it unless you want to run a unikernel for everything. And even then you may hit a CPU microcode bug it hardware bug...