5 ms·
Yet another buffer overflow. Probably the software is written by some C/C++ developers who swear that those never occur in their code. Given the large number of
by aliasEli 5y ago
Yet another buffer overflow. Probably the software is written by some C/C++ developers who swear that those never occur in their code. Given the large number of security problems that have been caused by buffer overflows and similar problems, I find it very sad that any programs that need security are still written in C/C++.
- netr0ute 5y agoC/C++ isn't the issue, it's the lack of not using memory-safe features like smart pointers which you'll need C++ for.
- nathanaldensr 5y agoWhile you're technically correct, your ignoring the pragmatic truth: most developers are terrible and should never write code. Because of this reality, C/C++ and all its footguns are something to be avoided unless there is no other alternative (usually this happens when integrating with legacy software or in industries like gaming where the switching costs are extreme).
- junon 5y agoSo you're saying that since we're encouraging people to flood the market with little to no skill, we should instead accommodate them with Baby's First Programming Language and then force all of the other developers to follow the same methodology? This makes no sense. It just sounds like Go.
- agumonkey 5y agoterrible programmers ain't nothing new though and large corp in critical fields are aware of that and have (or had) structural mitigations (slow and heavy processes, regulations etc)
- xaduha 5y agoGuns don't kill people, people kill people.
- catlifeonmars 5y agoPointers kill people
- gabereiser 5y agonull pointers kill people
- ndesaulniers 5y agoDangling pointers kill people.
- kumarjsingh6 5y agoredditizing HN kills people
- deleted 5y ago[deleted]
- scintill76 5y ago“We kill people based on memory safety.” - Michael Hayden, probably
- IshKebab 5y agoThis is sort of true, but show me a (non-trivial) C++ program that doesn't resort to naked pointers or references at some point. In the real world, smart pointers help a lot and are a great idea but they don't fully solve the problem in the same way that Rust or memory safe languages do.
- FounderBurr 5y agoIf you can’t be trusted to handle basic, simple non-creative tasks like managing memory and buffers you are not actually a professional programmer, though you might have convinced an employer otherwise.
- wmf 5y agoOften it's the employer encouraging the programmers to cut corners.
- bottled_poe 5y agoNo, it’s the market.
- jbverschoor 5y agoWith a lot of things I agree with this statement, but not about memory management in C. It's the "fault" of the programmer, but the language makes it very easy to make these faults, so I'd say it's the fault of the language.
- paavohtl 5y agoBy this logic no C or C++ developer in history is a professional programmer. Approximately zero non-trivial programs have been written in C or C++ without memory management problems and/or vulnerabilities.
- junon 5y agoThat's an ignorant and wrong assertion, spoken with an incredible amount of confidence. Look up software verification. There are verifiers for C.
- omegalulw 5y agoThis is misleading. Formally verifying the behaviour of any large software is a really tall task, no matter what language they are written in.
- mnd999 5y agoPlease don’t skip the prove hypothesis part when drawing conclusions. It’s at best disingenuous.