5 ms·

He doesnt like NSA calling C CPP unsafe cuz CPP is way safer than C and the fact that lang committee wasnt asked about their assessment. Then he recommends read

He doesnt like NSA calling C CPP unsafe cuz CPP is way safer than C and the fact that lang committee wasnt asked about their assessment. Then he recommends reading CPP safety guidelines and links some CPP proposals to make lang better. Also reminds that there various kinds of safety and trade offs. I think guidelines are poor ass method to improve security, especially when you can see that projects like Chromium still have a lot of mem. related safety.

drewm1980 4y ago
Yeah, that gripe about the C++ standards committee not being consulted is a bit petty. It's likely the NSA didn't consult ~any language maintainers; there is plenty of error rate data coming out of large corporations to go on.
josefx 4y ago
> projects like Chromium still have a lot of mem. related safety. Chrome might suffer from being a Google project. At least the old Google C++ style guides heavily pushed a C with classes approach and where outright hostile to every improvement over C new versions of the language brought along.
- danuker 4y ago
  My guess is the reason is C++ is complicated. When you have restrictive conventions, it is easier for a new dev to get onboard, as well as for creating static analysis tools.
  - erik_seaberg 4y ago
    Google C++ forbids exceptions, but C++ RAII works a lot better when a data member ctor can throw. The compiler will generate code tearing down a half-constructed object from that point, without you having to write a method that knows what to do and what not to.
    - UncleMeat 4y ago
      What percentage of CVEs in Chromium are caused by half-complete objects where a constructor throw would have prevented the issue? I certainly don't have an exhaustive view of things but no example is coming to mind right now. With [[noexcept]] everywhere I'd expect a constructor failing to just crash Chrome rather than proceed in some indeterminate state.
      - erik_seaberg 4y ago
        https://google.github.io/styleguide/cppguide.html#Exceptions https://google.github.io/styleguide/cppguide.html#Exceptions calls for factories or init methods (probably returning error codes) so running with an invalid state isn’t prevented by terminating the process. I don’t have access to CVEs on crbug.com but the top two from https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2023/01/stable-channel... are a use-after-free and buffer overflow reported months ago, which is the kind of stuff that modern C++ tries to avoid using containers and smart pointers with RAII.
        UncleMeat 4y ago
        Of course modern C++ tries to avoid this sort of thing now with smarter lifetime management, but what does that have to do with building with exceptions disabled?
        erik_seaberg 4y ago
        I think they use their own containers and smart pointers which require explicit initialization (more scope for mistakes), to avoid standard C++ classes whose copy/move ctors can throw.

drewm1980 4y ago

Yeah, that gripe about the C++ standards committee not being consulted is a bit petty. It's likely the NSA didn't consult ~any language maintainers; there is plenty of error rate data coming out of large corporations to go on.

josefx 4y ago

> projects like Chromium still have a lot of mem. related safety. Chrome might suffer from being a Google project. At least the old Google C++ style guides heavily pushed a C with classes approach and where outright hostile to every improvement over C new versions of the language brought along.

danuker 4y ago
My guess is the reason is C++ is complicated. When you have restrictive conventions, it is easier for a new dev to get onboard, as well as for creating static analysis tools.
- erik_seaberg 4y ago
  Google C++ forbids exceptions, but C++ RAII works a lot better when a data member ctor can throw. The compiler will generate code tearing down a half-constructed object from that point, without you having to write a method that knows what to do and what not to.
  - UncleMeat 4y ago
    What percentage of CVEs in Chromium are caused by half-complete objects where a constructor throw would have prevented the issue? I certainly don't have an exhaustive view of things but no example is coming to mind right now. With [[noexcept]] everywhere I'd expect a constructor failing to just crash Chrome rather than proceed in some indeterminate state.
    - erik_seaberg 4y ago
      https://google.github.io/styleguide/cppguide.html#Exceptions https://google.github.io/styleguide/cppguide.html#Exceptions calls for factories or init methods (probably returning error codes) so running with an invalid state isn’t prevented by terminating the process. I don’t have access to CVEs on crbug.com but the top two from https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html https://chromereleases.googleblog.com/2023/01/stable-channel... are a use-after-free and buffer overflow reported months ago, which is the kind of stuff that modern C++ tries to avoid using containers and smart pointers with RAII.
      - UncleMeat 4y ago
        Of course modern C++ tries to avoid this sort of thing now with smarter lifetime management, but what does that have to do with building with exceptions disabled?
        erik_seaberg 4y ago
        I think they use their own containers and smart pointers which require explicit initialization (more scope for mistakes), to avoid standard C++ classes whose copy/move ctors can throw.