4 ms·

Real world projects using C++ are seeing decreases in security vulnerabilities when migrating to Rust: https://security.googleblog.com/2022/12/memory-safe-lang

Real world projects using C++ are seeing decreases in security vulnerabilities when migrating to Rust: https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html?m=1 https://security.googleblog.com/2022/12/memory-safe-language... While C++ with the latest features should be secure enough in theory, in practice practically no one is using all the latest features just right to achieve the needed security. Sorry, the NSA report is correct. Using C or C++ opens your project up to memory safety risks. Use a memory safe language if at all possible.

gigel82 4y ago
I'm sure you'd be seeing the same results by rewriting the project in modern C++ instead of Rust.
- thesuperbigfrog 4y ago
  >> I'm sure you'd be seeing the same results by rewriting the project in modern C++ instead of Rust. I would personally choose Rust over C++. I dislike the number of gotchas that C++ has and I think the language has gotten too big and complex to use safely. In the article I linked above, the Google Android team stated: "To date, there have been zero memory safety vulnerabilities discovered in Android’s Rust code." Their C++ code requires more static analysis tools and fuzzers and does not have a comparable record. If modern C++ were as safe as Rust then why wouldn't they just use modern C++? It would be a lower effort rewrite and would not need new compilers.
  - simplotek 4y ago
    > I would personally choose Rust over C++. I dislike the number of gotchas that C++ has and I think the language has gotten too big and complex to use safely. This take sounds like fomo mixed with cargo cult programming. When you write something in C++, nothing forces you to use all features of C++. There is no bingo card you have to fill to get your project to compile. You just pick the things you feel serves your purposes, and stick with them. I don't really understand this irrational take. It's like claiming they don't want to speak in English because the dictionary is too large and some words are too tricky to spell to use in a conversation.
    - thesuperbigfrog 4y ago
      >> I don't really understand this irrational take. It's like claiming they don't want to speak in English because the dictionary is too large and some words are too tricky to spell to use in a conversation. It's not irrational to want to avoid trouble. Why would I want to use C++ with its plethora of gotchas, traps, caveats, pitfalls and footguns when I can use something safer and just as performant?
- Jweb_Guru 4y ago
  The Android study had a control: they compared to memory safety vulnerabilities in other greenfield projects written in modern C++. There was no significant improvement for the greenfield projects, even though they also benefited from improvements to static analysis. The improvements were reserved for Android, which had a large share of its new sensitive code written in Rust.
akvadrako 4y ago
Almost every project sees fewer issues with a rewrite, no matter which languages are involved.
- thesuperbigfrog 4y ago
  >> Almost every project sees fewer issues with a rewrite, no matter which languages are involved. That is provably false: https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/ https://www.joelonsoftware.com/2000/04/06/things-you-should-... There are numerous developers on this forum who could provide eyewitness accounts of project rewrite horror stories.
  - akvadrako 4y ago
    That is about incomplete rewrites because the original is too complex to be understood in the given time. The same thing would happen if you rewrote in rust.
    - thesuperbigfrog 4y ago
      You are correct that it is possible to have a rewrite go badly in any language. Rewriting a project in Rust can go badly depending on the circumstances. However, there are some patterns that Rust does not allow that other languages do allow which may help to avoid problems. For example, creating cyclic dependencies and relationships is more difficult in Rust due to the way that ownership rules are enforced. Rust also helps to avoid data races and memory unsafety issues so that whole classes of errors and bugs can be avoided.
  - simplotek 4y ago
    > That is provably false: You're confusing things. Google's example focused on rewriting specific components with a specific goal in mind: fix/avoid unsafe memory access. The examples in that blog post consist of major rewrites of huge software projects like browsers, whose goal was to be feature complete. Those are quite different things.
stevefan1999 4y ago
What if you used smart pointers all the way?
- thesuperbigfrog 4y ago
  >> What if you used smart pointers all the way? Why stop at smart pointers? I would rather use a smarter compiler / smarter language with fewer gotchas, traps, caveats, pitfalls and footguns.
- skyde 4y ago
  Smart pointer alone do not prevent race-condition. So racing thread accessing the same memory without lock would still corrupt the heap!
- Gigachad 4y ago
  Do smart pointers protect against unsafe uses of other resources like open files and threads? Rust safety goes beyond just memory safety.

gigel82 4y ago

I'm sure you'd be seeing the same results by rewriting the project in modern C++ instead of Rust.

thesuperbigfrog 4y ago
>> I'm sure you'd be seeing the same results by rewriting the project in modern C++ instead of Rust. I would personally choose Rust over C++. I dislike the number of gotchas that C++ has and I think the language has gotten too big and complex to use safely. In the article I linked above, the Google Android team stated: "To date, there have been zero memory safety vulnerabilities discovered in Android’s Rust code." Their C++ code requires more static analysis tools and fuzzers and does not have a comparable record. If modern C++ were as safe as Rust then why wouldn't they just use modern C++? It would be a lower effort rewrite and would not need new compilers.
- simplotek 4y ago
  > I would personally choose Rust over C++. I dislike the number of gotchas that C++ has and I think the language has gotten too big and complex to use safely. This take sounds like fomo mixed with cargo cult programming. When you write something in C++, nothing forces you to use all features of C++. There is no bingo card you have to fill to get your project to compile. You just pick the things you feel serves your purposes, and stick with them. I don't really understand this irrational take. It's like claiming they don't want to speak in English because the dictionary is too large and some words are too tricky to spell to use in a conversation.
  - thesuperbigfrog 4y ago
    >> I don't really understand this irrational take. It's like claiming they don't want to speak in English because the dictionary is too large and some words are too tricky to spell to use in a conversation. It's not irrational to want to avoid trouble. Why would I want to use C++ with its plethora of gotchas, traps, caveats, pitfalls and footguns when I can use something safer and just as performant?
Jweb_Guru 4y ago
The Android study had a control: they compared to memory safety vulnerabilities in other greenfield projects written in modern C++. There was no significant improvement for the greenfield projects, even though they also benefited from improvements to static analysis. The improvements were reserved for Android, which had a large share of its new sensitive code written in Rust.

akvadrako 4y ago

Almost every project sees fewer issues with a rewrite, no matter which languages are involved.

thesuperbigfrog 4y ago
>> Almost every project sees fewer issues with a rewrite, no matter which languages are involved. That is provably false: https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/ https://www.joelonsoftware.com/2000/04/06/things-you-should-... There are numerous developers on this forum who could provide eyewitness accounts of project rewrite horror stories.
- akvadrako 4y ago
  That is about incomplete rewrites because the original is too complex to be understood in the given time. The same thing would happen if you rewrote in rust.
  - thesuperbigfrog 4y ago
    You are correct that it is possible to have a rewrite go badly in any language. Rewriting a project in Rust can go badly depending on the circumstances. However, there are some patterns that Rust does not allow that other languages do allow which may help to avoid problems. For example, creating cyclic dependencies and relationships is more difficult in Rust due to the way that ownership rules are enforced. Rust also helps to avoid data races and memory unsafety issues so that whole classes of errors and bugs can be avoided.
- simplotek 4y ago
  > That is provably false: You're confusing things. Google's example focused on rewriting specific components with a specific goal in mind: fix/avoid unsafe memory access. The examples in that blog post consist of major rewrites of huge software projects like browsers, whose goal was to be feature complete. Those are quite different things.

stevefan1999 4y ago

What if you used smart pointers all the way?

thesuperbigfrog 4y ago
>> What if you used smart pointers all the way? Why stop at smart pointers? I would rather use a smarter compiler / smarter language with fewer gotchas, traps, caveats, pitfalls and footguns.
skyde 4y ago
Smart pointer alone do not prevent race-condition. So racing thread accessing the same memory without lock would still corrupt the heap!
Gigachad 4y ago
Do smart pointers protect against unsafe uses of other resources like open files and threads? Rust safety goes beyond just memory safety.