4 ms·

C++ can be used safely without memory safety issues. But it requires expertise with the language, which is a very steep barrier for most programmers, even ones

C++ can be used safely without memory safety issues. But it requires expertise with the language, which is a very steep barrier for most programmers, even ones on the Chrome team to pass successfully. In a project as large as Chrome the vast majority of programmers will not have the necessary expertise. And sadly, in this case, what you don't know will hurt you. Is that a reason for not using C++: maybe. But you would be hard pressed to find a more performant language that is mature and stable.

saagarjha 6y ago
Even the best software engineers make memory safety mistakes.
summerlight 6y ago
No, even world-class C++ experts can and will make subtle memory safety bugs across abstraction boundaries. Think about millions of lines of C++ codes which have their own assumptions on invariant and contract. Their time is a limited resource and for many cases memory safety is not the most valuable thing to put their efforts.
kbumsik 6y ago
> In a project as large as Chrome the vast majority of programmers will not have the necessary expertise. Wait, then what kind of devs would have enough expertise?
nindalf 6y ago
We need to let go of this idea that there are godlike engineers out there who can write perfect code. Everyone makes mistakes. As long as the compiler allows it, such mistakes will continue to happen. > in a project as large as Chrome the vast majority of programmers will not have the necessary expertise. Then how do we staff such projects? Hire only people with a track record of never writing such bugs? It’s not possible.
phkahler 6y ago
There is a big difference between "theoretically C++ could be written safely" and "Rust is safe."
acdha 6y ago
> In a project as large as Chrome the vast majority of programmers will not have the necessary expertise. So … you’re talking about Google not being able to pay enough or have a good enough reputation to hire developers who want to work on one of the highest-impact codebases in the world, not to mention contributing to the standards process and popular tools used to improve security for the entire community. Who realistically should look at that and say “no problem, we’ll do better!”?

saagarjha 6y ago

Even the best software engineers make memory safety mistakes.

summerlight 6y ago

No, even world-class C++ experts can and will make subtle memory safety bugs across abstraction boundaries. Think about millions of lines of C++ codes which have their own assumptions on invariant and contract. Their time is a limited resource and for many cases memory safety is not the most valuable thing to put their efforts.

kbumsik 6y ago

> In a project as large as Chrome the vast majority of programmers will not have the necessary expertise. Wait, then what kind of devs would have enough expertise?

nindalf 6y ago

We need to let go of this idea that there are godlike engineers out there who can write perfect code. Everyone makes mistakes. As long as the compiler allows it, such mistakes will continue to happen. > in a project as large as Chrome the vast majority of programmers will not have the necessary expertise. Then how do we staff such projects? Hire only people with a track record of never writing such bugs? It’s not possible.

phkahler 6y ago

There is a big difference between "theoretically C++ could be written safely" and "Rust is safe."

acdha 6y ago

> In a project as large as Chrome the vast majority of programmers will not have the necessary expertise. So … you’re talking about Google not being able to pay enough or have a good enough reputation to hire developers who want to work on one of the highest-impact codebases in the world, not to mention contributing to the standards process and popular tools used to improve security for the entire community. Who realistically should look at that and say “no problem, we’ll do better!”?