3 ms·
> It turns out that "discipline doesn't scale", and programmers have not been able to write substantial amounts of reliable and secure software using pointers.
by gajjanag 5y ago
> It turns out that "discipline doesn't scale", and programmers have not been able to write substantial amounts of reliable and secure software using pointers. Not Linus, not the BSD maintainers, not the OpenSSL team, not anyone. Not even with C++20 and a tool bag full of fuzzers and linters.
Well, Google has 100s of millions of lines of C++ that power much of the internet. They certainly have no intention of getting rid of this code, and have deemed the tradeoff worthwhile. Yes, in theory this C++ codebase might not be the most reliable or secure, but their practices are certainly scalable and battle tested. Not saying it is easy, but it is certainly possible to build an ecosystem around C++ with fuzzers/linters/whatever to reach an "acceptable" level in practice.
> Meanwhile, huge amounts of quite safe Java and C# code keep happily ticking along -- exposed to the internet -- often needing patches only for the C/C++ modules that they include as a part of some framework!
Not necessarily. Plenty of null pointer exceptions in production Java code that bring down systems. Yes, they are "safe" but I don't think the tens of millions of customers affected appreciate such subtle nuances: the consequences are the same for them.
I agree that there can be more severe consequences due to the lack of "safety" from exploits, privilege escalation, and what not. But with stuff like sandboxing, the broader ecosystem, etc the decision isn't as simple as your argument might suggest.
- pjmlp 5y agoThat is exactly the reason why Google is pushing for wide adoption of hardware memory tagging as the ultimate solution to fix that C and C++ code, because the dead corpses from battle testing have proven it is not enough. https://source.android.com/devices/tech/debug/tagged-pointers https://source.android.com/devices/tech/debug/tagged-pointer... https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html https://security.googleblog.com/2019/08/adopting-arm-memory-... https://threatpost.com/google-arm-android-bugs-memory-tagging/146950/ https://threatpost.com/google-arm-android-bugs-memory-taggin... https://source.android.com/devices/tech/debug/hwasan https://source.android.com/devices/tech/debug/hwasan Google also paid for the effort to remove C99's VLAs from the Linux kernel. https://www.phoronix.com/scan.php?page=news_item&px=Linux-Kills-The-VLA https://www.phoronix.com/scan.php?page=news_item&px=Linux-Ki... Google is also the company that started the effort to adopt Rust in the Linux kernel. https://security.googleblog.com/2021/04/rust-in-linux-kernel.html https://security.googleblog.com/2021/04/rust-in-linux-kernel... So they definitely know how much money it costs them to keep C and C++ around, and are taking actions to reduce that monetary cost related to fixing security bugs. On the other hand, they just introduced the Android Game Development Kit, with C and C++ APIs. https://developer.android.com/games/agdk https://developer.android.com/games/agdk