4 ms·

They are not band aids. Analysis tools for C exceed anything you can have in Rust or Go compiler in scope and features.

danieltillett 10y ago
Exactly. The real problem is many C developers are unaware of these tools. Rather than just saying use programming language x, we should be helping people use C with the right tools.
- pjmlp 10y ago
  Not at all. These tools exist since 1979, it hasn't changed anything. C doesn't deserve a place on any security conscious developer toolbox.
pjmlp 10y ago
Something that is optional doesn't exceed what are standard safety features in programming languages since Algol and its derived languages exist. Having external tools to track out of bonds errors, use after free, double free, free bad pointers, implicit conversions and UB, errors that don't happen in another languages is band aid. Other languages just don't need them thanks to being designed with safety first.
- danieltillett 10y ago
  I write in C (mostly) and very few of my bugs are the typical errors C is famous for - 99.9% are logic bugs that can occur in any language. I have lots of great tools to catch the C type bugs - I wish I had a tool to catch my logic bugs. Tests can only find the bugs where the code doesn't do what I expect, not where what I expect is wrong.
  - pjmlp 10y ago
    Which tells me that you work alone without other devs of various skillsets messing around your beautiful C code.
    - danieltillett 10y ago
      Well I wouldn't call my C code beautiful, but no I don't work alone. I do only work with devs better than me :)
- Nokinside 10y ago
  >Other languages just don't need them thanks to being d esigned with safety first. Other languages are not used for writing safety critical code. Language features are not even close being enough for that.
  - pjmlp 10y ago
    Ada and SPARK are such languages, better improve your knowledge.
    - Nokinside 10y ago
      I specially mentioned Ada with C/C++ in my first post that started the tread. No need to defensively boast if you realize that you are wrong.
      - pjmlp 10y ago
        I don't need to be defensive in any way. The band-aids called MISRA-C, Frama-C, High Integrity C++ and DOD certifications are a mechanism to force Ada safe like semantics in C and C++, while paying lower salaries, instead of hiring Ada devs. F-35 proves how good they work out in large scale projects.
  - deleted 10y ago
    [deleted]

Exactly. The real problem is many C developers are unaware of these tools. Rather than just saying use programming language x, we should be helping people use C with the right tools.

pjmlp 10y ago
Not at all. These tools exist since 1979, it hasn't changed anything. C doesn't deserve a place on any security conscious developer toolbox.

pjmlp 10y ago

Something that is optional doesn't exceed what are standard safety features in programming languages since Algol and its derived languages exist. Having external tools to track out of bonds errors, use after free, double free, free bad pointers, implicit conversions and UB, errors that don't happen in another languages is band aid. Other languages just don't need them thanks to being designed with safety first.

danieltillett 10y ago
I write in C (mostly) and very few of my bugs are the typical errors C is famous for - 99.9% are logic bugs that can occur in any language. I have lots of great tools to catch the C type bugs - I wish I had a tool to catch my logic bugs. Tests can only find the bugs where the code doesn't do what I expect, not where what I expect is wrong.
- pjmlp 10y ago
  Which tells me that you work alone without other devs of various skillsets messing around your beautiful C code.
  - danieltillett 10y ago
    Well I wouldn't call my C code beautiful, but no I don't work alone. I do only work with devs better than me :)
Nokinside 10y ago
>Other languages just don't need them thanks to being d esigned with safety first. Other languages are not used for writing safety critical code. Language features are not even close being enough for that.
- pjmlp 10y ago
  Ada and SPARK are such languages, better improve your knowledge.
  - Nokinside 10y ago
    I specially mentioned Ada with C/C++ in my first post that started the tread. No need to defensively boast if you realize that you are wrong.
    - pjmlp 10y ago
      I don't need to be defensive in any way. The band-aids called MISRA-C, Frama-C, High Integrity C++ and DOD certifications are a mechanism to force Ada safe like semantics in C and C++, while paying lower salaries, instead of hiring Ada devs. F-35 proves how good they work out in large scale projects.
- deleted 10y ago
  [deleted]