4 ms·

C++ hasn't been compiled to C in any production compiler for a rather long time.

tomjen3 16y ago
Properly not, but the fact is that it can, and has been. Therefore it is still possible to do so today, which means that his claim still stand.
- jacquesm 16y ago
  Yes, but it is the first time that I see Charles Stross make a mistake like that. Usually he's pixel perfect when it comes to the state of tech. Well, at least he seems to know that cfront was once the only way to use C++.
- jemfinch 16y ago
  C++ can only be compiled to C in the same sense that ANY language can be compiled to C. The point is moot if that's all that's being claimed.
- tptacek 16y ago
  The point wouldn't make sense even if its premise was accurate. The JVM is also implemented in C. But you don't see a lot of ASCIIZ overflows in Java code. The C++ std::string class doesn't suffer from C's wild-west memory handling on cfront-style compilers.
froydnj 16y ago
This is true; it's unfortunate that Stross is misinformed on this point. But it's also true that all the weaknesses of C are still present in C++. (I suppose std::string mitigates the char* damage in C somewhat, though I suspect there are rather too many APIs out there still using char*. And the lack of bounds checking is an ever-present problem...)
- tptacek 16y ago
  The better point to make would be that nobody writes much C++ these days either.
  - froydnj 16y ago
    I don't buy that. Maybe it's true in the "reads Hacker News" monoculture (or the "comments on Hacker News" monoculture), but that sample is not representative of the wider programming world. Apple's not going to spend several million dollars of engineering effort to create another C++ compiler if nobody's writing C++. Companies aren't going to spend money on sending representatives to C++0x standards meetings if their customers aren't using C++. People are realizing that they don't have to program in C++ for many different areas. That doesn't mean that they're aren't still writing parts of their apps in C++. And there's a lot of existing C++ code out there that still has to be extended, debugged, and maintained.
    - tptacek 16y ago
      I don't know. My company is on any given week reviewing code for as many as 15 different applications, for companies running the gamut from web startups to Win32 desktop software vendors to embedded software vendors. I stand by my assertion. Most people aren't writing in C/C++ anymore. Even the embedded vendors find ways to avoid it.
      - froydnj 16y ago
        Fair enough. Perhaps all the C++ effort is simply a dying gasp from the collective industry. In any event, we're talking to different sets of embedded vendors. The embedded vendors I talk to are still using C++ and so are their customers. Maybe I'm talking to the less profitable ones, though. ;)
        tptacek 16y ago
        I can't imagine how C++ standardization efforts could possibly correlate in any way with industry adoption. The two things are completely orthogonal. C++ hasn't been eradicated, but --- even in some embedded environments --- it is no longer the go-to language (Java seems to have that honor now). Bringing this back to Stross' point, though: ASCIIZ strings aren't more relevant to modern computer security because of C++. Obviously, C++ disfavors them (though most C++ devs I know still drop to charstars when std::string gets frustrating), but, more importantly, they have almost nothing to do with Java, C#, Python, or PHP string handling.

Properly not, but the fact is that it can, and has been. Therefore it is still possible to do so today, which means that his claim still stand.

jacquesm 16y ago
Yes, but it is the first time that I see Charles Stross make a mistake like that. Usually he's pixel perfect when it comes to the state of tech. Well, at least he seems to know that cfront was once the only way to use C++.
jemfinch 16y ago
C++ can only be compiled to C in the same sense that ANY language can be compiled to C. The point is moot if that's all that's being claimed.
tptacek 16y ago
The point wouldn't make sense even if its premise was accurate. The JVM is also implemented in C. But you don't see a lot of ASCIIZ overflows in Java code. The C++ std::string class doesn't suffer from C's wild-west memory handling on cfront-style compilers.

froydnj 16y ago

This is true; it's unfortunate that Stross is misinformed on this point. But it's also true that all the weaknesses of C are still present in C++. (I suppose std::string mitigates the char* damage in C somewhat, though I suspect there are rather too many APIs out there still using char*. And the lack of bounds checking is an ever-present problem...)

tptacek 16y ago
The better point to make would be that nobody writes much C++ these days either.
- froydnj 16y ago
  I don't buy that. Maybe it's true in the "reads Hacker News" monoculture (or the "comments on Hacker News" monoculture), but that sample is not representative of the wider programming world. Apple's not going to spend several million dollars of engineering effort to create another C++ compiler if nobody's writing C++. Companies aren't going to spend money on sending representatives to C++0x standards meetings if their customers aren't using C++. People are realizing that they don't have to program in C++ for many different areas. That doesn't mean that they're aren't still writing parts of their apps in C++. And there's a lot of existing C++ code out there that still has to be extended, debugged, and maintained.
  - tptacek 16y ago
    I don't know. My company is on any given week reviewing code for as many as 15 different applications, for companies running the gamut from web startups to Win32 desktop software vendors to embedded software vendors. I stand by my assertion. Most people aren't writing in C/C++ anymore. Even the embedded vendors find ways to avoid it.
    - froydnj 16y ago
      Fair enough. Perhaps all the C++ effort is simply a dying gasp from the collective industry. In any event, we're talking to different sets of embedded vendors. The embedded vendors I talk to are still using C++ and so are their customers. Maybe I'm talking to the less profitable ones, though. ;)
      - tptacek 16y ago
        I can't imagine how C++ standardization efforts could possibly correlate in any way with industry adoption. The two things are completely orthogonal. C++ hasn't been eradicated, but --- even in some embedded environments --- it is no longer the go-to language (Java seems to have that honor now). Bringing this back to Stross' point, though: ASCIIZ strings aren't more relevant to modern computer security because of C++. Obviously, C++ disfavors them (though most C++ devs I know still drop to charstars when std::string gets frustrating), but, more importantly, they have almost nothing to do with Java, C#, Python, or PHP string handling.