3 ms·

That sentence stood out to me as well. I don't think C++ developers is necessarily the best people to ask when discussing whether memory safety is important and

by sakjur 3y ago

That sentence stood out to me as well. I don't think C++ developers is necessarily the best people to ask when discussing whether memory safety is important and urgent to work on or not. A lot of developers are relatively shielded from the consequences of bugs and security vulnerabilities, either by their programs not being exposed to the wild in any major sense or by bureaucracy being in between them and any consequences. At some point, the deficiencies of a language becomes a concern for its end-users rather than its developers.

JohnFen 3y ago
> the deficiencies of a language becomes a concern for its end-users rather than its developers. I think that this level of professional malpractice is something that can't be solved by language choice.
- eviks 3y ago
  But the level of damage can be reduced by language choice
  - JohnFen 3y ago
    Maybe, but surely the better answer is for devs to do better.
    - iFreilicht 3y ago
      That actually seems unrealistic to me. Of course, people will always become better at doing the things they do, and we can always try harder, but many of these issues take time to consider and find during code reviews, and a few just slip by. That's why tools like Coverity exist, but you have to spend time and money to set those up, meaning it's only done when absolutely necessary (or one dedicated person is really pushing for it). Choosing a different language is basically free in the beginning, and it will impact which sort of bugs will be caught by default and which won't. C++ is also massively hurt in this regard by not having a package manager. JS is a very risky language by default, but a few tools just with their default settings will already help massively. I guess Nix could be considered the missing package manager for C and C++, but it's still niche and definitely not a "default" like pip, npm or cargo.

by sakjur 3y ago

JohnFen 3y ago

> the deficiencies of a language becomes a concern for its end-users rather than its developers. I think that this level of professional malpractice is something that can't be solved by language choice.

eviks 3y ago
But the level of damage can be reduced by language choice
- JohnFen 3y ago
  Maybe, but surely the better answer is for devs to do better.
  - iFreilicht 3y ago
    That actually seems unrealistic to me. Of course, people will always become better at doing the things they do, and we can always try harder, but many of these issues take time to consider and find during code reviews, and a few just slip by. That's why tools like Coverity exist, but you have to spend time and money to set those up, meaning it's only done when absolutely necessary (or one dedicated person is really pushing for it). Choosing a different language is basically free in the beginning, and it will impact which sort of bugs will be caught by default and which won't. C++ is also massively hurt in this regard by not having a package manager. JS is a very risky language by default, but a few tools just with their default settings will already help massively. I guess Nix could be considered the missing package manager for C and C++, but it's still niche and definitely not a "default" like pip, npm or cargo.