4 ms·

Windows Defender has been around since Vista (XP, if you include systems it didn't ship with). More important than that nitpick - do you really see no conceiva

by dsacco 9y ago

Windows Defender has been around since Vista (XP, if you include systems it didn't ship with). More important than that nitpick - do you really see no conceivable justification for using C++? Really? None? The entire language is unsuitable for new development? And somehow, you captured this insight which managed to be overlooked by all the engineers working at Microsoft? What do you suggest we do? Gather the whole world, hold hands as one and unite in abandoning the language? Cast it aside for...what, exactly?

Analemma_ 9y ago
Yes, I see no conceivable justification. A program running with maximum privilege that automatically reads every incoming file? Writing such a component in a memory-unsafe language is almost criminal negligence.
lmm 9y ago
> The entire language is unsuitable for new development? Yes. > And somehow, you captured this insight which managed to be overlooked by all the engineers working at Microsoft? Apparently. Astonishing that they didn't, but the fact that they managed to ship this bug is already astonishing, so any explanation of how that happened will also be astonishing. > What do you suggest we do? Gather the whole world, hold hands as one and unite in abandoning the language? Cast it aside for...what, exactly? Mostly OCaml, probably - I guess F# in Microsoft's case. Maybe Rust or Ada in places where we absolutely need non-GC, if any of those turn out to actually exist.
- youdontknowtho 9y ago
  There really aren't any codebases the size of Linux or Windows written in those languages. I'm not saying that there couldn't be, but there isn't currently. There is also a great deal of effort being put into making C++ more robust. When there finally are large codebases written in Rust, it will be apparent that there are still some of the same issues. I think that I agree with you though that there may not be real cases where GC won't work anymore.
sqeaky 9y ago
While I agree with much of your response I specifically disagree with the notion that a single person on the outside cannot identify a problem with the decision making of an insular group. Many people in microsoft seem to be thoroughly stuck in the microsoft way of doing things even when not ideal. How many COM objects did they for years after COM was dead? For how long did they ignore the concept of an AST during parsing of C++? Even in msvc2015 rev 3 you can't reliably turn this feature on for even a moderately sized codebase, but it is the default for GCC and Clang and has been for years. There might be a lot of smart people as microsoft, but they are often isolated from cutting edge ideas or squashed by bureaucracy. I even really like C++, but perhaps for a security product that isn't particularly performance sensitive something else would have been better. It doesn't seem to run all the time like other AV products and just at the boundaries where information can get in and out this means it does a lot less work and has looser performance constraints, perhaps they could have used C# another in house languages.
ScottBurson 9y ago
> The entire language is unsuitable for new development? Arguably, yes. Look at the outcome: a component specifically intended to improve system security has been found to have multiple extremely severe vulnerabilities. If Microsoft can't write memory-safe C++ code, even with PREfix at their disposal, maybe high-privilege code shouldn't be written in C++.

by dsacco 9y ago

Analemma_ 9y ago

Yes, I see no conceivable justification. A program running with maximum privilege that automatically reads every incoming file? Writing such a component in a memory-unsafe language is almost criminal negligence.

lmm 9y ago

> The entire language is unsuitable for new development? Yes. > And somehow, you captured this insight which managed to be overlooked by all the engineers working at Microsoft? Apparently. Astonishing that they didn't, but the fact that they managed to ship this bug is already astonishing, so any explanation of how that happened will also be astonishing. > What do you suggest we do? Gather the whole world, hold hands as one and unite in abandoning the language? Cast it aside for...what, exactly? Mostly OCaml, probably - I guess F# in Microsoft's case. Maybe Rust or Ada in places where we absolutely need non-GC, if any of those turn out to actually exist.

youdontknowtho 9y ago
There really aren't any codebases the size of Linux or Windows written in those languages. I'm not saying that there couldn't be, but there isn't currently. There is also a great deal of effort being put into making C++ more robust. When there finally are large codebases written in Rust, it will be apparent that there are still some of the same issues. I think that I agree with you though that there may not be real cases where GC won't work anymore.

sqeaky 9y ago

While I agree with much of your response I specifically disagree with the notion that a single person on the outside cannot identify a problem with the decision making of an insular group. Many people in microsoft seem to be thoroughly stuck in the microsoft way of doing things even when not ideal. How many COM objects did they for years after COM was dead? For how long did they ignore the concept of an AST during parsing of C++? Even in msvc2015 rev 3 you can't reliably turn this feature on for even a moderately sized codebase, but it is the default for GCC and Clang and has been for years. There might be a lot of smart people as microsoft, but they are often isolated from cutting edge ideas or squashed by bureaucracy. I even really like C++, but perhaps for a security product that isn't particularly performance sensitive something else would have been better. It doesn't seem to run all the time like other AV products and just at the boundaries where information can get in and out this means it does a lot less work and has looser performance constraints, perhaps they could have used C# another in house languages.

ScottBurson 9y ago

> The entire language is unsuitable for new development? Arguably, yes. Look at the outcome: a component specifically intended to improve system security has been found to have multiple extremely severe vulnerabilities. If Microsoft can't write memory-safe C++ code, even with PREfix at their disposal, maybe high-privilege code shouldn't be written in C++.