3 ms·
Majority of CVE's are memory corruption. It is not possible to move into the future without resolving this problem. If we don't fix it now you will be regulated
by devwastaken 3y ago
Majority of CVE's are memory corruption. It is not possible to move into the future without resolving this problem. If we don't fix it now you will be regulated to inferior solutions in the future. Software will be tied up in red tape just like building bridges.
It will be interesting to watch insurance and liability protection require devs to act professional and choose proper tools, not excuse poor engineering with "just use old things I know."
- uecker 3y agoThere are plenty of other bugs causing CVEs, but there are certainly a lot caused by memory issues. I personally believe that C needs a safe mode, but also with existing tools (static analysis, sanitizers, etc.) one can improve things a lot. It is a bit unfair to compare billions of lines of old C code to newly written code in other languages. It would be interesting to compare modern C with modern tools to other languages. And, of course, all those billions of lines of old C code will continue to exist even if some people start to use other languages. So I think we need to improve C instead of abandoning it.
- devwastaken 3y agoThere isn't "modern C". You have to completely change the language to approach modern understanding of memory safety. C is the way it is because it was ignorant of what we know now. Progression of knowledge is why we deprecate and remove older tools.
- uecker 3y agoThis is Rust marketing but not reality. There are tools that ensure memory safety in C. Just - unfortunately - not open-source tools.