3 ms·
I use C++ on a daily basis. I am extremely proficient in it. It is an observable and downright undeniable fact that developers, even expert developers, cannot
by UncleMeat 4y ago
I use C++ on a daily basis. I am extremely proficient in it.
It is an observable and downright undeniable fact that developers, even expert developers, cannot consistently write correct C++ code. This is true even if you have a greenfield project that uses all of the modern best practices and you don't have the keyword "new" anywhere in your codebase. People fuck up lifetimes. People fuck up iterators. People fuck up integer arithmetic. People fuck up concurrency. Using a subset of the language and relying on modern tooling like sanitizers will not save you.
- ncmncm 4y agoThis does not match my experience. It has been literally years since I shipped a memory usage bug. It just doesn't come up. There is no temptation to make memory usage bugs, because they would be extra work to code. I understand that there is a sub-literature devoted to making up stories about how the C++ experience is exactly identical to C's, by people insisting they are active, competent C++ coders, but there are almost always clues that this is false.
- UncleMeat 4y agoYou are free to collect data and publish a revolutionary result in ICSE or whatever. Until then I'll go with the mountains of data showing the existence of these bugs in codebases despite adoption of smart pointers, etc. You can even see the pain in the adoption of string_view as a clear example of how you end up with non-owning references in real modern C++ code that fucks up lifetimes and ends up with UAFs. You don't need a "new" anywhere in your entire codebase to still end up with UAF. I also spoke about way more than memory errors. C++ has a million other footguns that people regularly fire beyond accessing deallocated memory or accessing memory out of bounds of an allocation.