4 ms·
A lot of you seem to be working on commercial solutions to C's insecurity. Does this feel like a conflict of interest to you?
by rvp-x 7y ago
A lot of you seem to be working on commercial solutions to C's insecurity. Does this feel like a conflict of interest to you?
- rseacord 7y agoGood question, but not at all! I've been working as hard as I can for the past 15 years to improve C Language security as have other security-minded members of the committee. Generally speaking, we are in the minority as performance is still the major driver for the language. Any security solution that introduces > 5% overhead, for example, is a nonstarter. I think we all understand that are jobs are completely safe no matter what security improvements we can get adopted. The committee works a lot lobbyist. A minority of people with a large financial interest in the technology (such as compiler writers) have undue influence because they participate in the process. I always encourage C language users to take a more active role, but they usually don't. Cisco is an example of user community that actively takes part in C Standardization.
- pjmlp 7y agoI guess this is why vendors like Apple, Oracle, ARM and Google end up going the hardware memory tagging route instead.
- pascal_cuoq 7y agoI have been told in this very AMA that I lacked enthusiasm about C (and the gratuitous insecurity of the language when we know that a well-designed type system and a few runtime checks solve the problem entirely is indeed the reason for my perceived lack of enthusiasm): https://news.ycombinator.com/item?id=22865912 https://news.ycombinator.com/item?id=22865912 I hope that this perceived lack of enthusiasm means I am handling the conflict of interest honorably.