6 ms·
> Every embedded/kernel/driver developer know what they are doing. Yet we still see security issues in all of those. I'm not saying that everything should be
by dx87 7y ago
> Every embedded/kernel/driver developer know what they are doing.
Yet we still see security issues in all of those. I'm not saying that everything should be re-written in a different language, but C developers saying "I'm a good developer, all those safety mechanisms would hold me back" doesn't hold water considering all the security vulnerabilities we see that would have been prevented if they had used a language with better safeguards.
- scoutt 7y ago> Yet we still see security issues in all of those That's the typical excuse. That's the FUD I mentioned about. Bugs will keep existing and so security issues, no matter the language you use.
- pjmlp 7y agoWe need regulation to make companies liable for CVEs, then this will stop being FUD, easy.
- jcranmer 7y agoIt says something of our profession that we have all of our products come with a legal document that effectively says it's not our fault if the product doesn't do what it's supposed to do.
- perl4ever 7y agoWe should just outlaw those damn statements (and binding arbitration for consumers) and see how the market naturally evolves. Don't force standards on programmers, don't regulate in some novel way, just get rid of the stupid disclaimers and let the old-fashioned legal framework return to primacy.
- hurrrrrrrr 7y agoBut if we get rid of a whole class of bugs and vulnerabilities, the number of bugs will go down, no?
- scoutt 7y agoThis is a common way of thinking about it, but nobody really knows. It's purely a conjecture. There is no data to back it up, and it just appeals to common sense. Should everybody drop C/C++/whatever and rush into the Rust train because Rust people has conjecture? I ask the opposite question. What would happen if the only programming language left is C? Wouldn't we become better programmers and raise the bar so high that the bug count drops to 0?
- whatshisface 7y ago>Should everybody drop C/C++/whatever and rush into the Rust train because Rust people has conjecture? The way these things usually work in practice, the evidence that a new paradigm improves things usually builds up slowly. There will never be a point at which someone proves mathematically that C is obsolete. Instead, the gentle advantages of other options will get stronger and stronger, and the effectiveness of C programmers will slowly erode compared to their competition. At first only the people who are really interested in technology will switch, but eventually only the curmudgeons will be left, clinging to an ineffective technology and using bad justifications to convince themselves they aren't handicapped. Is Rust the thing that everyone except the curmudgeons will eventually switch to? Who knows, but if you don't want to end up behind the industry then it might pay to try it out in production to see for yourself. If you don't make room for research and its attendant risks you will inevitably fall behind.
- scoutt 7y agoI'm sorry you see things in terms of competition and curmudgeons. But I see your point, it's just another type of FUD: don't stay behind and adopt Rust because you'll be a curmudgeon.
- whatshisface 7y agoNot exactly, I'm saying that if you stay behind and don't adopt something, where that something is whatever the industry switches to after C, you will eventually be left behind. Of course it is also possible (and likely for many people) to die or retire before that happens. It's not like C is going away any time soon.