3 ms·
They don't have GC so they either make programs difficult to write (Rust) which hinders delivering secure replacements, or have use-after-free security problems
by fulafel 4y ago
They don't have GC so they either make programs difficult to write (Rust) which hinders delivering secure replacements, or have use-after-free security problems (Zig) [1].
Use a GC when you can, it's the biggest programming productivity and quality improvement in PLT of the last 60+ years.
[1] Though I know Zig has some interesting mitigations, some used and some under research: https://news.ycombinator.com/item?id=31853964 https://news.ycombinator.com/item?id=31853964 https://lobste.rs/s/v5y4jb/how_safe_is_zig#c_vddk9j https://lobste.rs/s/v5y4jb/how_safe_is_zig#c_vddk9j
- valenterry 4y agoSure, I agree - I don't think what you said contradicts my point.
- drran 4y agoRust doesn't have GC, but it has very good automatic memory management. GC or memory management doesn't make programs immune to buffer overflows, which is the most common security vulnerability these days, while use-after-free is at 4th place.
- fulafel 4y agoWhat do you mean by automatic memory management here? (I misspoke a bit with "Rust doesn't have GC", it does have opt in basic GC in the form of ref counting, but it's not used much because a headline feature of Rust is code without GC and I guess libs with interfaces requiring GC would be considered uncool)
- bitwize 4y agoModern automatic memory management techniques like RAII and ARC largely render GC obsolete.
- pjmlp 4y agoReference counting is hardly modern, and is a GC algorithm.