3 ms·
> has an order of magnitude more security issues But then there is a LOT more C/C++ software as well, so it makes sense that when you have a lot more code you
by badsectoracula 6y ago
> has an order of magnitude more security issues
But then there is a LOT more C/C++ software as well, so it makes sense that when you have a lot more code you'll also have a lot more bugs.
> than (similarly well written) software in other languages.
Why isn't that similarly well written software being used instead of the C/C++ software when the latter ends up with more bugs?
> And until recently C and C++ were more or less the only viable options for writing it.
I do not think that this is the case, there have been alternatives for pretty much as long as C existed. For example Object Pascal existed for decades before Rust and while it doesn't have as many compile-time guarantees as Rust does, it still is safer than C and C++, provides a similar amount of functionality while not losing in terms of low level functionality. Yet outside of a few exceptions (mainly during Borland's heyday) people still went with C or C++ despite those languages not providing anything special compared to it.
And there have been other languages too - i've seen Ada being brought up often as a much safer language (safer than Pascal too) with a strong type system, yet still being usable even on tiny devices.
What makes people stick with C and C++ when other solutions existed for years and how would Rust change that when other languages apparently failed?
- swsieber 6y ago> But then there is a LOT more C/C++ software as well, so it makes sense that when you have a lot more code you'll also have a lot more bugs. 70% of C/C++ security bugs are memory management bugs. Those don't (for the most part) exist in GC'd or other non-manually managed memory languages. > Why isn't that similarly well written software being used instead of the C/C++ software when the latter ends up with more bugs? Performance and low level control. Familiarity. etc.
- steveklabnik 6y ago(The statistic you're citing did not separate by language, it was "70% of security bugs are memory safety bugs" only, no language break-out.)
- swsieber 6y agoThanks Steve. I'm going to have to do more research I see :)
- anKlamsno 6y agoThis correct viewpoint is always down-voted because it is uncomfortable to the clique of something like 20 HN members that fanatically control every Rust thread.