3 ms·

My point is that they can't consistently write correct software in any language. Javascript for example has similar issues where if you're not careful about whi

My point is that they can't consistently write correct software in any language. Javascript for example has similar issues where if you're not careful about which keys in a hashmap you write to you can create situations that allow for all kinds of things including arbitrary code execution. Modern C compilers/runtimes also have bounds checking (although I've never used it) like java if you want to use it. Sure there's some improvement but it's not nearly as extreme as it's made out to be.

quotemstr 4y ago
It's true that humans will inevitably produce software with defects. There are differences in the impacts of these defects. > Javascript for example has similar issues where if you're not careful about which keys in a hashmap you write to you can create situations that allow for all kinds of things including arbitrary code execution. Not without eval() you can't. > Modern C compilers/runtimes also have bounds checking No, they don't. There are C-like languages (e.g. C++/CLI) that do, and you can use containers, but no, plain C cannot do bounds checking. There's no room in the ABI for it, at least not without CHERI or ASAN. > although I've never used it One of the most dangerous things in the world is giving powerful tools to people who don't know that they shouldn't use them.
svnt 4y ago
> My point is that they can’t consistently write correct software in any language. Javascript for example I don’t think Javascript is the counterexample you want to use as a good language. It is like C where safety is traded for flexibility. If people can’t write correct software in any language, the language designers can help, which is exactly what the Rust designers did. It’s not great for everyone because now all the scar tissue that great C devs have around what near-fatal errors they’ve made previously has lost some of its value.

quotemstr 4y ago

It's true that humans will inevitably produce software with defects. There are differences in the impacts of these defects. > Javascript for example has similar issues where if you're not careful about which keys in a hashmap you write to you can create situations that allow for all kinds of things including arbitrary code execution. Not without eval() you can't. > Modern C compilers/runtimes also have bounds checking No, they don't. There are C-like languages (e.g. C++/CLI) that do, and you can use containers, but no, plain C cannot do bounds checking. There's no room in the ABI for it, at least not without CHERI or ASAN. > although I've never used it One of the most dangerous things in the world is giving powerful tools to people who don't know that they shouldn't use them.

svnt 4y ago

> My point is that they can’t consistently write correct software in any language. Javascript for example I don’t think Javascript is the counterexample you want to use as a good language. It is like C where safety is traded for flexibility. If people can’t write correct software in any language, the language designers can help, which is exactly what the Rust designers did. It’s not great for everyone because now all the scar tissue that great C devs have around what near-fatal errors they’ve made previously has lost some of its value.