4 ms·
Oh come one, you're describing a single dependency which being encryption is generally recommended against rolling your own. Don't try and tell me C++ projects
by pfundstein 6y ago
Oh come one, you're describing a single dependency which being encryption is generally recommended against rolling your own.
Don't try and tell me C++ projects in general have more dependencies than high level languages.
- rossjudson 6y agoNope, but I'm happy to tell you that C/C++ projects in general have more security flaws than high level languages.
- pfundstein 6y agoDon't shift the goal posts, we're talking specifically about dependencies and dependency driven bugs.
- dodobirdlord 6y agoLanguages like C++ that lack memory safety have the irritating property that a memory safety error anywhere in the dependency tree can be exploited to attack unrelated parts of the binary. In most languages you don’t have to worry that some stateless pure-function log formatter is secretly the gap in your armor.
- gigel82 6y agoThat's superficial. How many "high level languages" roll their own SSL from scratch? I'd bet most of them link down to the C++ libssl, so of course that one gets a lot of heat, but it also means it's a very robust piece of software.
- PaulDavisThe1st 6y agoI'll try: https://nightly.ardour.org/i/A_Linux_i386/info.txt https://nightly.ardour.org/i/A_Linux_i386/info.txt That's the dependency stack for a 350k LOC cross-platform C++ project. I'll leave it to your judgement if this is more or less than "high level languages".
- pfundstein 6y agoCherry picking is pointless and doesn't prove anything
- TylerE 6y agoNeither does just invoking No True Scotsman at every turn.
- rcxdude 6y agoThey certainly don't have less to a degree which makes up for the lack of tooling to support it. C++ dependency management is a nightmare which dwarfs even the worst of npm. Even if it were to half the number of dependencies it doesn't make up for the 10 times more dependency and build-related issues which appear.