10 ms·

"But modern c++ is safe, preventing all those errors is as easy as not making them!..."

by tumdum_ 3y ago

deleted 3y ago
[deleted]
littlestymaar 3y ago
In fairness, only 2 of those 4 are actually memory-related.
- tialaramex 3y ago
  I agree that in principle the neutralization bugs aren't something C++ is necessarily making worse than, say, Python. But it'd be fascinating to see a study to figure out whether C++ programmers make these mistakes more often, or less often, or roughly the same. An argument for more often: C++ is so complicated, maybe you're too busy with other problems to address the neutralization issue An argument for less often: C++ teaches you to be careful and check everything to avoid nasty outcomes so that carries over to neutralization
- tumdum_ 3y ago
  In fairness, only C/C++ of all the currently commonly used languages can have half of the 4 top dangerous software weaknesses.
  - littlestymaar 3y ago
    JavaScript routinely has the other half of the top4.
    - tatersolid 3y ago
      So do C and C++ when used in web or database applications. So they get 4/4
- deadletters 3y ago
  And both have existing tools to find those bugs that people often just don't use.
  - pjmlp 3y ago
    Since 1979 with the invention of lint by Stephen Johnson at Bell Labs. https://en.wikipedia.org/wiki/Lint_(software) https://en.wikipedia.org/wiki/Lint_(software)
    - UncleMeat 3y ago
      Static analysis as a bugfinding tool has proven to be insufficient, especially for large C++ binaries and JS programs. Both languages are nightmares for precise and scalable analysis. Coverity exists. They've got a great product. But it doesn't solve the problem.
      - pjmlp 3y ago
        It doesn't solve everything, it solves even less when it isn't used.
        UncleMeat 3y ago
        Of course. But these issues will remain near the top of the list indefinitely if people just leverage traditional analysis tools. I love static analysis. I did my PhD in it. But we'll still be talking about use after free in 2073 if we just try to chase higher K in our analysis implementations.
        pjmlp 3y ago
        Naturally static analysis alone doesn't fix use after free in all possible cases, however it already does fix several of them when the analyser can see everything on the existing source code. The main issue is the community sub-culture of not adopting tooling as it isn't perfect 100% of the time. Many of the C++ security conscious folks end up being polyglot, as this subculture eventually wears one out.
citrin_ru 3y ago
Is there some authoritative source for what is considered modern C++ and what is old? Most projects I've seen use a wide mix of C++ features of varying age. If you use some C++23 futures it would not make it modern if you still use C++98 features you not supposed to use.
- zabzonk 3y ago
  not authoritative, but the really big c++ change was with c++11 - changes after that have been important, but perhaps more or less transparent to the average c++ user. and compiler support for c++11 is very good.
- SubjectToChange 3y ago
  “Modern C++” is not necessarily tied to any specific standard, it is more a collection of ideas and philosophies. Although if I had to pick I’d say it really started with C++11.
- tumdum_ 3y ago
  No, there's no such authoritative source - depending on context C++ fans will mix and match what is 'modern'. It's somewhat similar to the C/C++ split. When it is convenient it's "C/C++" because "you can easily migrate your old C codebase to C++". But in other situations it's "C++", because C is old and more error prone and "we no longer manipulate raw pointers".
- pjmlp 3y ago
  Originally it refers to what was already possible in C++98, when one leaves behind the legacy ways of coding C with a C++ compiler. Started with the publishing of "Modern C++ Design" from Andrei Alexandrescu in 2001. https://en.wikipedia.org/wiki/Modern_C%2B%2B_Design https://en.wikipedia.org/wiki/Modern_C%2B%2B_Design When ISO C++11 came to be, many re-used the term to mean C++11 or higher. Given that many keep updating this to mean more modern versions, a well known developer in the community (Tony Van Eerd) has made the joke of that by C++17 time we were in Postmodern C++. https://www.youtube.com/watch?v=QTLn3goa3A8 https://www.youtube.com/watch?v=QTLn3goa3A8 No idea what kind of modernism to call C++23, when C++17 was already postmodern, maybe Revivalist C++. However it basically comes back to Andrei Alexandrescu's original ideas of programming in C++ as its own language, leave the C ways and pitfalls of resource management behind, learn to embrace a modern language for systems programming. I should also note that there are developers against this philosophy, they advocate that the C++ as understood by CFront is what one should care about, thus Orthodox C++ movement was born. https://gist.github.com/bkaradzic/2e39896bc7d8c34e042b https://gist.github.com/bkaradzic/2e39896bc7d8c34e042b

"But modern c++ is safe, preventing all those errors is as easy as not making them!..."

deleted 3y ago

[deleted]

littlestymaar 3y ago

In fairness, only 2 of those 4 are actually memory-related.

tialaramex 3y ago
I agree that in principle the neutralization bugs aren't something C++ is necessarily making worse than, say, Python. But it'd be fascinating to see a study to figure out whether C++ programmers make these mistakes more often, or less often, or roughly the same. An argument for more often: C++ is so complicated, maybe you're too busy with other problems to address the neutralization issue An argument for less often: C++ teaches you to be careful and check everything to avoid nasty outcomes so that carries over to neutralization
tumdum_ 3y ago
In fairness, only C/C++ of all the currently commonly used languages can have half of the 4 top dangerous software weaknesses.
- littlestymaar 3y ago
  JavaScript routinely has the other half of the top4.
  - tatersolid 3y ago
    So do C and C++ when used in web or database applications. So they get 4/4
deadletters 3y ago
And both have existing tools to find those bugs that people often just don't use.
- pjmlp 3y ago
  Since 1979 with the invention of lint by Stephen Johnson at Bell Labs. https://en.wikipedia.org/wiki/Lint_(software) https://en.wikipedia.org/wiki/Lint_(software)
  - UncleMeat 3y ago
    Static analysis as a bugfinding tool has proven to be insufficient, especially for large C++ binaries and JS programs. Both languages are nightmares for precise and scalable analysis. Coverity exists. They've got a great product. But it doesn't solve the problem.
    - pjmlp 3y ago
      It doesn't solve everything, it solves even less when it isn't used.
      - UncleMeat 3y ago
        Of course. But these issues will remain near the top of the list indefinitely if people just leverage traditional analysis tools. I love static analysis. I did my PhD in it. But we'll still be talking about use after free in 2073 if we just try to chase higher K in our analysis implementations.
        pjmlp 3y ago
        Naturally static analysis alone doesn't fix use after free in all possible cases, however it already does fix several of them when the analyser can see everything on the existing source code. The main issue is the community sub-culture of not adopting tooling as it isn't perfect 100% of the time. Many of the C++ security conscious folks end up being polyglot, as this subculture eventually wears one out.

citrin_ru 3y ago

Is there some authoritative source for what is considered modern C++ and what is old? Most projects I've seen use a wide mix of C++ features of varying age. If you use some C++23 futures it would not make it modern if you still use C++98 features you not supposed to use.

zabzonk 3y ago
not authoritative, but the really big c++ change was with c++11 - changes after that have been important, but perhaps more or less transparent to the average c++ user. and compiler support for c++11 is very good.
SubjectToChange 3y ago
“Modern C++” is not necessarily tied to any specific standard, it is more a collection of ideas and philosophies. Although if I had to pick I’d say it really started with C++11.
tumdum_ 3y ago
No, there's no such authoritative source - depending on context C++ fans will mix and match what is 'modern'. It's somewhat similar to the C/C++ split. When it is convenient it's "C/C++" because "you can easily migrate your old C codebase to C++". But in other situations it's "C++", because C is old and more error prone and "we no longer manipulate raw pointers".
pjmlp 3y ago
Originally it refers to what was already possible in C++98, when one leaves behind the legacy ways of coding C with a C++ compiler. Started with the publishing of "Modern C++ Design" from Andrei Alexandrescu in 2001. https://en.wikipedia.org/wiki/Modern_C%2B%2B_Design https://en.wikipedia.org/wiki/Modern_C%2B%2B_Design When ISO C++11 came to be, many re-used the term to mean C++11 or higher. Given that many keep updating this to mean more modern versions, a well known developer in the community (Tony Van Eerd) has made the joke of that by C++17 time we were in Postmodern C++. https://www.youtube.com/watch?v=QTLn3goa3A8 https://www.youtube.com/watch?v=QTLn3goa3A8 No idea what kind of modernism to call C++23, when C++17 was already postmodern, maybe Revivalist C++. However it basically comes back to Andrei Alexandrescu's original ideas of programming in C++ as its own language, leave the C ways and pitfalls of resource management behind, learn to embrace a modern language for systems programming. I should also note that there are developers against this philosophy, they advocate that the C++ as understood by CFront is what one should care about, thus Orthodox C++ movement was born. https://gist.github.com/bkaradzic/2e39896bc7d8c34e042b https://gist.github.com/bkaradzic/2e39896bc7d8c34e042b