4 ms·

> One memory error per 1000 LOC? From his link: "Historical vulnerability density is greater than 1/kLOC (1 vulnerability per thousand lines of code) in many o

by zapnuk 4y ago

> One memory error per 1000 LOC? From his link: "Historical vulnerability density is greater than 1/kLOC (1 vulnerability per thousand lines of code) in many of Android’s C/C++ components (e.g. media, Bluetooth, NFC, etc). Based on this historical vulnerability density, it’s likely that using Rust has already prevented hundreds of vulnerabilities from reaching production."

FpUser 4y ago
As already said this error rate for released code seems way too high. No idea what they're doing internally but they definitely doing something wrong. Probably sticking to old style with lots of explicit memory management.
- pjmlp 4y ago
  Yeah, but that is the thing, most C++ shops write code exactly like that, regardless of what a few iluminated souls write about modern C++ and static analysis best pratices. Not even Bjarne's continuous preaching seems to affect current practices, as most folks don't do social activities regarding their day job programming languages.
  - 72deluxe 4y ago
    But that's not the language's fault. As a C++ developer I worked with developers who were scared to use the STL and were using MFC containers in 2017. Still using Visual Studio 2008 because it would take a mammoth task to move the 6.5 million LOC to a modern IDE. They eventually did it when I left but even the senior developers were oblivious to C++11 features like move semantics, lambdas etc. Hopeless. It's not the fault of the language if developers are lazy or use the tool badly.
    - nindalf 4y ago
      Yeah it's not quite language's fault if the language provides a better way to do the same . But equally, the language does provide a bad way to do things. A developer in a hurry, or a developer trying to follow the existing convention in the code base, or a developer making a reasonable assumption that's later invalidated - there's no sense in blaming these folks either. We can admonish them all we like, but the bugs keep appearing. I think it's better to be hard on tools, not people. We can make give the people better tools. Telling them the tool is fine and the problem is with them isn't productive and doesn't lead to better software.
    - pjmlp 4y ago
      It is not the car's fault if people manage to crash and die by not using ESP, ABS and seatbelts.

by zapnuk 4y ago

FpUser 4y ago

As already said this error rate for released code seems way too high. No idea what they're doing internally but they definitely doing something wrong. Probably sticking to old style with lots of explicit memory management.

pjmlp 4y ago
Yeah, but that is the thing, most C++ shops write code exactly like that, regardless of what a few iluminated souls write about modern C++ and static analysis best pratices. Not even Bjarne's continuous preaching seems to affect current practices, as most folks don't do social activities regarding their day job programming languages.
- 72deluxe 4y ago
  But that's not the language's fault. As a C++ developer I worked with developers who were scared to use the STL and were using MFC containers in 2017. Still using Visual Studio 2008 because it would take a mammoth task to move the 6.5 million LOC to a modern IDE. They eventually did it when I left but even the senior developers were oblivious to C++11 features like move semantics, lambdas etc. Hopeless. It's not the fault of the language if developers are lazy or use the tool badly.
  - nindalf 4y ago
    Yeah it's not quite language's fault if the language provides a better way to do the same . But equally, the language does provide a bad way to do things. A developer in a hurry, or a developer trying to follow the existing convention in the code base, or a developer making a reasonable assumption that's later invalidated - there's no sense in blaming these folks either. We can admonish them all we like, but the bugs keep appearing. I think it's better to be hard on tools, not people. We can make give the people better tools. Telling them the tool is fine and the problem is with them isn't productive and doesn't lead to better software.
  - pjmlp 4y ago
    It is not the car's fault if people manage to crash and die by not using ESP, ABS and seatbelts.