3 ms·

> Well, yes if the strawman "all modern C++ written by experts is free from memory safety issues" is what you're countering. Well, I have seen exactly that sen

> Well, yes if the strawman "all modern C++ written by experts is free from memory safety issues" is what you're countering. Well, I have seen exactly that sentiment. But, more importantly, this isn't exactly an obscure memory safety issue. It's a huge collection of flaws that showed up the instant Dmitry Vyukov threw a fuzzer at it. It's not just "all expertly-written C++ is free of memory safety issues" that this is a counterexample to: it's also a counterexample to "most C++ written by experts doesn't have memory safety issues that matter in practice". > I find that to be gratuitous and petty, and not a good representation of Rust, however. I haven't brought up Rust here. You can eliminate the memory safety issues by writing in Go, or Java, or C#, etc. etc.

sidlls 10y ago
> Well, I have seen exactly that sentiment. Then surely you can provide a reference to it. > it's also a counterexample to "most C++ written by experts doesn't have memory safety issues that matter in practice". This is "most C++ written by experts"? At least you're willing to back off your initial ridiculous assertion somewhat. This one isn't much better though. > I haven't brought up Rust here. Oh come on, you can't be serious given your advocacy for Rust.
- pcwalton 10y ago
  > This is "most C++ written by experts"? Boost is peer-reviewed and receives more scrutiny than most C++ in the wild. Its peer review is its major selling point, in fact. > Oh come on, you can't be serious given your advocacy for Rust. I think it's possible for me to be able to express opinions in favor of memory safe programming languages in general (which is what I'm doing here) while also having worked on one. If someone were to say "this illustrates why you should use Go for untrusted regexes", I'd agree with them!
  - blub 10y ago
    Boost.regex was peer reviewed in 2001, the same year XP was released and three years before Firefox was released. Modern C++. Let's talk about the state of security back then if you want and compare. The disappointing thing in this is that they haven't done a security review and put a plan in place for handling security. Par for the course in the world of software development, sadly.
- dang 10y ago
  This comment crosses into incivility. Please don't do that on HN.
pvg 10y ago
Well, I have seen exactly that sentiment. I've seen it too but as a bunch of other people pointed out, the C++ in this library is not the C++ that sort of sentiment is about. This seems like the criticism you should be responding to.

sidlls 10y ago

> Well, I have seen exactly that sentiment. Then surely you can provide a reference to it. > it's also a counterexample to "most C++ written by experts doesn't have memory safety issues that matter in practice". This is "most C++ written by experts"? At least you're willing to back off your initial ridiculous assertion somewhat. This one isn't much better though. > I haven't brought up Rust here. Oh come on, you can't be serious given your advocacy for Rust.

pcwalton 10y ago
> This is "most C++ written by experts"? Boost is peer-reviewed and receives more scrutiny than most C++ in the wild. Its peer review is its major selling point, in fact. > Oh come on, you can't be serious given your advocacy for Rust. I think it's possible for me to be able to express opinions in favor of memory safe programming languages in general (which is what I'm doing here) while also having worked on one. If someone were to say "this illustrates why you should use Go for untrusted regexes", I'd agree with them!
- blub 10y ago
  Boost.regex was peer reviewed in 2001, the same year XP was released and three years before Firefox was released. Modern C++. Let's talk about the state of security back then if you want and compare. The disappointing thing in this is that they haven't done a security review and put a plan in place for handling security. Par for the course in the world of software development, sadly.
dang 10y ago
This comment crosses into incivility. Please don't do that on HN.

pvg 10y ago

Well, I have seen exactly that sentiment. I've seen it too but as a bunch of other people pointed out, the C++ in this library is not the C++ that sort of sentiment is about. This seems like the criticism you should be responding to.