3 ms·
> The point is that they're easy to make, and though there is tooling, it's extremely cumbersome and imperfect. What's hard about adding -fsanitize=address or
by 2trill2spill 9y ago
> The point is that they're easy to make, and though there is tooling, it's extremely cumbersome and imperfect.
What's hard about adding -fsanitize=address or -Weverything to your Makefile? Or running a program under Valgrind, or using the clang static analyzer or coverity? Using AFL can be a little cumbersome but still not that hard.
- seba_dos1 9y agoDepending on what you're doing, AddressSanitizer might not be available for you to use, as there are plenty of ASAN-incompatible constructs that may be used by libraries your application depends on. (it's worth looking at other sanitizers anyway, it seems not everyone is aware of their existence after all; if you can't put C away they're really great tools for retaining your sanity :))
- irundebian 9y agoIn contrast to Rust's language design, -fsanitize and -Weverything and static source code analyzer can't give guarantees over memory safety. Considering that your main activity in your Github profile is concentrated on JavaScript, I wouldn't be so cheeky. Feel free to post your self-written applications (no fuzzers or similar with uninteresting attack surfaces) written in C for open review.
- Peaker 9y agoYou can't use -Weverything on a real project. It's full of noise. You can enable many others though, but -Weverything is virtually useless.