4 ms·
Given the universality of C++, everyone effectively ends up writing in their own dialect and there is a sizeable faction that uses it as "C with Classes" and "C
by eps 9y ago
Given the universality of C++, everyone effectively ends up writing in their own dialect and there is a sizeable faction that uses it as "C with Classes" and "C with templates". So there is a lot of C++ projects that explicitly steer clear of modern C++ features, especially derived from the mother of all unholy abominations and the manifestation of everything that is wrong with the modern C++, the boost library.
Give or take.
- pjmlp 9y agoUsually those are the projects where CVEs are a common feature..
- whatidonteven 9y agoThey are also the projects that get the most attention. I wouldn't rule out that python/javascript/whatever projects have just as many, if not even more, security flaws than your typical widely-used C library. They are just not interesting enough to warrant the required attention. The flaws are likely to be more subtle than simple buffer overflows too, think of all the abstractions involved.
- pjmlp 9y agoMy point was "C with Classes" and "C with templates" versus modern C++ best practices. C++ code can be quite safe, providing people stop writing C with C++ compilers.
- huhtenberg 9y ago... as are the projects that overdo on "modern C++" to the extent of introducing even more severe problems masked by the layers of needless abstraction. CVEs don't come from C or C++. They come from the lack of coding discipline and with all other things being equal C programmers are generally better skilled and more diligent than their C++ counterparts.
- pjmlp 9y ago> C programmers are generally better skilled and more diligent than their C++ counterparts. That is not what the CVEs on Linux prove. https://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm... One would expect, on a C project with the rigor of review process that patches go through and the usual assement I keep hearing since the early 90's about C programmer skills, now repeated again by you, that Linux would have 0 CVEs reported. The majority of exploits in C++ are related to its copy-paste compatibility with C, and devs that insist in using them in spite of the language offering safer, better, alternatives.
- huhtenberg 9y ago> That is not what the CVEs on Linux prove. You picked one of the largest, complex and most scrutinized C projects of the whole time and compared its CVE count... to what exactly?
- pjmlp 9y agoExactly because it is "largest, complex and most scrutinized C projects of the whole time" and yet it is impossible to use C without producing a couple of CVEs every single month. And a good example against the myth that the skilled C programmer that doens't produce memory corruption exists.
- huhtenberg 9y ago> Exactly Again - what are you comparing Linux CVE counts to? You can't point at an absolute count for A while arguing that A is inferior to B. I see nothing to support the assumption that a Linux-sized project in C++ would've have any less of CVEs. > the myth that the skilled C programmer that doens't produce memory corruption exists. Don't put words in my mouth. You are refuting a point that I didn't make. I said that C programmers are generally better skilled than C++ ones, which is not a "myth".
- 9y ago