4 ms·

Yeah that stuck out to me, too. The fucking kernel is written in C. 90% or more of the networking stack is written in C. Graphics APIs are written in C. Compile

Yeah that stuck out to me, too. The fucking kernel is written in C. 90% or more of the networking stack is written in C. Graphics APIs are written in C. Compilers, databases, firmwares, older video games, everything. C is not known for vulnerabilities, it simply makes it easy to shoot yourself in the foot. The tooling exists to improve code safety, but generally if you don't do anything crazy, nothing crazy happens. Lasers, chainsaws and pressure washers are all easy to hurt one's self with but I wouldn't say they're known for creating injuries. It's more like people are stupid enough to hurt themselves with tools regularly. It's not hard to check a value before dereferencing or freeing it. It's hard to remember to do it.

yencabulator 3y ago
Lasers are so known for creating eye injuries they come with warning stickers. Chainsaws are so known for accidents they come with warning pamphlets instructing you in how to use them in ways that minimize the risk -- including recommendations for wearing reinforced chaps to protect your legs. So, following your comparison, it should be perfectly valid to apply a warning sticker to C that says "Warning: Known to state of California to cause data corruption and accidental code execution".
- zlg_codes 3y ago
  Except all programming languages can corrupt data. Even knives with sheaths can be misused to harm one's self. Are we gonna include warnings for SQL injection risk? This is a stupid premise.
  - yencabulator 3y ago
    > Are we gonna include warnings for SQL injection risk? No, we've moved to calling conventions that avoid SQL injections: bind params. That argument speaks for minimizing use of C, not in its defense.
    - zlg_codes 3y ago
      No, all I'm seeing from you is "it's possible to break in C therefore C bad." It's okay to admit you don't like a programming language.
      - yencabulator 3y ago
        Constructing SQL by string manipulation is hard to get right, hence we largely stopped doing that. Same story with C, really. It's okay to admit you're irrationally attached to a tool, and calling things stupid because of it.

yencabulator 3y ago

Lasers are so known for creating eye injuries they come with warning stickers. Chainsaws are so known for accidents they come with warning pamphlets instructing you in how to use them in ways that minimize the risk -- including recommendations for wearing reinforced chaps to protect your legs. So, following your comparison, it should be perfectly valid to apply a warning sticker to C that says "Warning: Known to state of California to cause data corruption and accidental code execution".

zlg_codes 3y ago
Except all programming languages can corrupt data. Even knives with sheaths can be misused to harm one's self. Are we gonna include warnings for SQL injection risk? This is a stupid premise.
- yencabulator 3y ago
  > Are we gonna include warnings for SQL injection risk? No, we've moved to calling conventions that avoid SQL injections: bind params. That argument speaks for minimizing use of C, not in its defense.
  - zlg_codes 3y ago
    No, all I'm seeing from you is "it's possible to break in C therefore C bad." It's okay to admit you don't like a programming language.
    - yencabulator 3y ago
      Constructing SQL by string manipulation is hard to get right, hence we largely stopped doing that. Same story with C, really. It's okay to admit you're irrationally attached to a tool, and calling things stupid because of it.