3 ms·

I think it depends a lot on experience and wether the code base is post C++ 11. Modern codebases like clang or chrome do not seem to have any more memory manage

I think it depends a lot on experience and wether the code base is post C++ 11. Modern codebases like clang or chrome do not seem to have any more memory management issues than something like Intellij. Personally I wrote system software in C++ for 10 years and memory management was a problem maybe once or twice.

dan-robertson 5y ago
> chrome See https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/opec-1/Google-Chrome.html https://www.cvedetails.com/vulnerability-list/vendor_id-1224... for a list of RCE vulnerabilities. I see a bunch of memory management problems there. Also note that chrome is likely much better tested than some other C++ project, and lots of tools are used to search for potential vulnerabilities or invalid memory use as well as fuzzing and crash reports from a large install base. I don’t know how this compares with IntelliJ/Java (which I also don’t particularly like). I would expect other C++ applications to have a higher defect rate than chrome due to less testing/tooling but also likely a lower attack surface area.
- jstimpfle 5y ago
  Never contain programs so few bugs, as when no debugging tools are available - Niklaus Wirth Fuzzers and testing can detect bugs but I don't see how they can make a contribution to a reasonable software structure (I believe that bad structure is the prime cause of bugs).
  - dan-robertson 5y ago
    The other tools being talked about are static analysis tools or runtime instrumentation both designed specifically to try to find bad memory use patterns. I don’t mean this in a rude way, but I don’t care what you believe, because the thing I care about is evidence. If you have some actual evidence for your claim, I would be interested. (I also believe there can be improvements from better code structure in a rewrite and this can make up for a significant portion of the improvements from a ‘let’s rewrite it all in rust’ project).
    - jstimpfle 5y ago
      I think the burden is on you to show how fuzzers can show bad code structure and suggest better organization, instead of just finding bugs. I would be interested what is the evidence that you're talking about. If my experience doesn't speak to your experience, so be it.
- ncmncm 5y ago
  Chrome is not coded in anything even slightly resembling modern C++. So, no conclusions about modern C++ can be drawn from it. Except, maybe, that it takes a long time to modernize old code.
  - dan-robertson 5y ago
    I’m merely trying to respond to a comment that claims that chrome should have few memory management bugs. I don’t really have an opinion about whether it is modern. I don’t care enough about the distinction between C++ styles to know where to find evidence of the rate of memory management problems in modern C++ codebases. Perhaps I would just find that the definition of modern C++ is ‘the style of C++ where you don’t write code with memory management bugs’ (I.e. if I were to try to find an example it would not be a true Scotsman)
    - ncmncm 5y ago
      We all know Chrome is buggy as hell, and coded in the crabbed Google language subset. You may read in numerous places what modern C(+ code looks like. There is no need to guess.

dan-robertson 5y ago

> chrome See https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/opec-1/Google-Chrome.html https://www.cvedetails.com/vulnerability-list/vendor_id-1224... for a list of RCE vulnerabilities. I see a bunch of memory management problems there. Also note that chrome is likely much better tested than some other C++ project, and lots of tools are used to search for potential vulnerabilities or invalid memory use as well as fuzzing and crash reports from a large install base. I don’t know how this compares with IntelliJ/Java (which I also don’t particularly like). I would expect other C++ applications to have a higher defect rate than chrome due to less testing/tooling but also likely a lower attack surface area.

jstimpfle 5y ago
Never contain programs so few bugs, as when no debugging tools are available - Niklaus Wirth Fuzzers and testing can detect bugs but I don't see how they can make a contribution to a reasonable software structure (I believe that bad structure is the prime cause of bugs).
- dan-robertson 5y ago
  The other tools being talked about are static analysis tools or runtime instrumentation both designed specifically to try to find bad memory use patterns. I don’t mean this in a rude way, but I don’t care what you believe, because the thing I care about is evidence. If you have some actual evidence for your claim, I would be interested. (I also believe there can be improvements from better code structure in a rewrite and this can make up for a significant portion of the improvements from a ‘let’s rewrite it all in rust’ project).
  - jstimpfle 5y ago
    I think the burden is on you to show how fuzzers can show bad code structure and suggest better organization, instead of just finding bugs. I would be interested what is the evidence that you're talking about. If my experience doesn't speak to your experience, so be it.
ncmncm 5y ago
Chrome is not coded in anything even slightly resembling modern C++. So, no conclusions about modern C++ can be drawn from it. Except, maybe, that it takes a long time to modernize old code.
- dan-robertson 5y ago
  I’m merely trying to respond to a comment that claims that chrome should have few memory management bugs. I don’t really have an opinion about whether it is modern. I don’t care enough about the distinction between C++ styles to know where to find evidence of the rate of memory management problems in modern C++ codebases. Perhaps I would just find that the definition of modern C++ is ‘the style of C++ where you don’t write code with memory management bugs’ (I.e. if I were to try to find an example it would not be a true Scotsman)
  - ncmncm 5y ago
    We all know Chrome is buggy as hell, and coded in the crabbed Google language subset. You may read in numerous places what modern C(+ code looks like. There is no need to guess.