3 ms·

The immense number of C bugs is not merely due to C's popularity. Other languages lead to less buggy and more secure code. This is largely due to memory safety

The immense number of C bugs is not merely due to C's popularity. Other languages lead to less buggy and more secure code. This is largely due to memory safety. However, immutability is also known to reduce bugs and be more secure (as many security related bugs are due to mutability). Lastly, superior concurrency constructs also have this bug-reducing effect. That said I haven't looked into empirical studies. But I feel like it is just factually the case, at least for memory safety, that in most other languages you literally are unable to create entire classes of bugs that are possible in C. So just logically thinking about it, I don't even see why you'd need to see empirical studies. It should be quite obvious! Although it'd be cool to see the empirical research too! Maybe someone else can reply with links to studies.

mpweiher 5y ago
> But I feel like it is just factually the case, Aka truthiness. [1] Or when this is asserted for safety, safyness. [2] [1] https://en.wikipedia.org/wiki/Truthiness https://en.wikipedia.org/wiki/Truthiness [2] https://blog.metaobject.com/2014/06/the-safyness-of-static-typing.html https://blog.metaobject.com/2014/06/the-safyness-of-static-t...
- tikhonj 5y ago
  Memory safety is literally the only relevant topic in this whole thread whose impact isn't "truthy" in that sense! We can measure how many bugs and security vulnerabilities in real projects are memory issues, and we know that a memory safe language would rule those bugs out by construction. And we have! This blog post[1] is a good starting point, linking to a number of studies. Empirical evidence is never perfect, but that's much stronger evidence than we have for the impact of pretty much any other aspect of a programming languages! [1]: https://alexgaynor.net/2020/may/27/science-on-memory-unsafety-and-security/ https://alexgaynor.net/2020/may/27/science-on-memory-unsafet...
- samatman 5y ago
  Your mistake was taking @chillpenguin at their word when they said "I feel". That was just a hedge, it is factually the case that memory safety eliminates an entire class of bugs. More accurately, it pushes them down to the garbage collector and runtime, where they can be epsilon close to eliminated, instead of rolling fresh ones in each and every program.

mpweiher 5y ago

> But I feel like it is just factually the case, Aka truthiness. [1] Or when this is asserted for safety, safyness. [2] [1] https://en.wikipedia.org/wiki/Truthiness https://en.wikipedia.org/wiki/Truthiness [2] https://blog.metaobject.com/2014/06/the-safyness-of-static-typing.html https://blog.metaobject.com/2014/06/the-safyness-of-static-t...

tikhonj 5y ago
Memory safety is literally the only relevant topic in this whole thread whose impact isn't "truthy" in that sense! We can measure how many bugs and security vulnerabilities in real projects are memory issues, and we know that a memory safe language would rule those bugs out by construction. And we have! This blog post[1] is a good starting point, linking to a number of studies. Empirical evidence is never perfect, but that's much stronger evidence than we have for the impact of pretty much any other aspect of a programming languages! [1]: https://alexgaynor.net/2020/may/27/science-on-memory-unsafety-and-security/ https://alexgaynor.net/2020/may/27/science-on-memory-unsafet...
samatman 5y ago
Your mistake was taking @chillpenguin at their word when they said "I feel". That was just a hedge, it is factually the case that memory safety eliminates an entire class of bugs. More accurately, it pushes them down to the garbage collector and runtime, where they can be epsilon close to eliminated, instead of rolling fresh ones in each and every program.