5 ms·

I don't think anyone believes that Linux will be "riddled with security vulns" nor do they think it's acceptable. It would seem you have a war to wage on C for

I don't think anyone believes that Linux will be "riddled with security vulns" nor do they think it's acceptable. It would seem you have a war to wage on C for periodic bugs written by users of the language, and are ignoring the colossal amount of perfectly decent, working, good code written in C and C++. This sort of thing seems to happen whenever there's an article on C/C++ and it's wearisome. Many people suddenly appear and proclaim that the languages are terrible and should die and mumble something about memory safety, when I myself haven't got any problems writing memory-safe C++ and haven't had any problems for decades. Sure, some others do but it doesn't mean the LANGUAGE is terrible; it means the USERS of the language make mistakes. On further investigation, a lot of the vocal haters of C++ turn out to not really use the language that much and therefore means the vocal whining about the language has as much relevance as me complaining about masculine/femenine/neuter when I get der/die/das wrong in German when I only learned it at school decades ago and never ever use it - that is, completely irrelevant. People would rightly roll their eyes if I started complaining about der/die/das when I used it wrong in a sentence. As a simple analogy, whenever there's a car crash we don't see thousands of people saying that cars should be banned and replaced by trains because "cars are dangerous!"; we understand that the USERS of the cars are at fault, NOT the cars themselves. The same is true with C/C++ - you can make mistakes but you can make dumb mistakes in ANY language. That's why programming is a practiced skill and not something you learn overnight.

UncleMeat 4y ago
There exist C and C++ projects that have zero memory safety vulns. There also exist C and C++ projects that don't operate on untrusted data and so the consequences of a memory safety error are just crashes. I don't believe that the Chrome or Android developers are especially unique developers. I think that they are a decent proxy for a typical developer on a large project that has significant adversaries. These projects are developed by companies that use better-than-typical tooling to detect vulns. So I believe that these projects are good examples of what you can expect from ordinary developers using the most recommended safety tools. And... they are full of vulns. If you own a project that is developed entirely by extremely skilled developers or has no significant security characteristics then that's different. But if some person is hiring a bunch of engineers to build and maintain a project that has nontrivial security implications, I think that these projects are decent proxies for the best you can hope for. I do not believe that it is possible to train an org of developers to safely write a complex project that has nontrivial security implications in C++. I've been writing C++ code for well over a decade and a significant portion of my career involves static analysis of C++ code. "The haters just don't use C++" is not a compelling argument, in my opinion. In fact, you can find members of the C++ committee who agree that it isn't acceptable for the long term safety of software. Surely they "use the language." --- Analogies won't ever produce meaningful argumentation here. You can say that Rust is a train and that C++ is a car. I can say that Rust is more like a car with a bunch of modern safety features like lane assist and anti-lock brakes. That's not going to get us anywhere.
- 72deluxe 4y ago
  Very interesting reply, thanks. I am not sure how much C++ some of the book writers actually write - some of their advice and patterns don't seem usable in the real world. I should say that the majority of very vocal "haters" that appear on C++ topics appear to not use it and instead just show up to burn the C++ flag in a public space.

UncleMeat 4y ago

There exist C and C++ projects that have zero memory safety vulns. There also exist C and C++ projects that don't operate on untrusted data and so the consequences of a memory safety error are just crashes. I don't believe that the Chrome or Android developers are especially unique developers. I think that they are a decent proxy for a typical developer on a large project that has significant adversaries. These projects are developed by companies that use better-than-typical tooling to detect vulns. So I believe that these projects are good examples of what you can expect from ordinary developers using the most recommended safety tools. And... they are full of vulns. If you own a project that is developed entirely by extremely skilled developers or has no significant security characteristics then that's different. But if some person is hiring a bunch of engineers to build and maintain a project that has nontrivial security implications, I think that these projects are decent proxies for the best you can hope for. I do not believe that it is possible to train an org of developers to safely write a complex project that has nontrivial security implications in C++. I've been writing C++ code for well over a decade and a significant portion of my career involves static analysis of C++ code. "The haters just don't use C++" is not a compelling argument, in my opinion. In fact, you can find members of the C++ committee who agree that it isn't acceptable for the long term safety of software. Surely they "use the language." --- Analogies won't ever produce meaningful argumentation here. You can say that Rust is a train and that C++ is a car. I can say that Rust is more like a car with a bunch of modern safety features like lane assist and anti-lock brakes. That's not going to get us anywhere.

72deluxe 4y ago
Very interesting reply, thanks. I am not sure how much C++ some of the book writers actually write - some of their advice and patterns don't seem usable in the real world. I should say that the majority of very vocal "haters" that appear on C++ topics appear to not use it and instead just show up to burn the C++ flag in a public space.