4 ms·

Given the number of CVEs that can be directly attributed to C and C++ you only need to be half-joking to argue that approximately nobody has managed to learn th

Given the number of CVEs that can be directly attributed to C and C++ you only need to be half-joking to argue that approximately nobody has managed to learn the languages sufficiently to write production code in them.

josephg 3y ago
As uncomfortable as this is to say, the existence of latent security vulnerabilities doesn’t seem to stop people from shipping a lot of apparently working code in C and C++. And I don’t think a lot of those CVEs come from people misunderstanding the languages. As I understand it they mostly come from honest software bugs. C++ makes it easy for honest mistakes by experts to become security nightmares. This is a controversial opinion - but I think the fault is in C and C++ themselves. Not the programmers who need to work even harder such that they stop ever making mistakes.
- vacuity 3y ago
  Which is why some people push for no longer using C and C++ as much as possible. It's just not feasible to expect the average programmer to avoid all the security pitfalls. Of course, whether Rust is the best option isn't a given.
  - josephg 3y ago
    There aren’t a lot of memory safe options if you want the kind of performance rust offers. Rust is fine, but it’s far from perfect. It’s hard to learn, complex, and the macro and async systems are honestly a bit of a mess. I’m really looking forward to whatever comes after rust. I’m hoping some bright sparks out there manage to make a language with rust’s memory safety but that cleans up some of rust’s rough edges.
    - tracker1 3y ago
      To be fair, how many applications really need Rust's level of performance? I mean operating system code and drivers... But, many apps are getting the job done in electron with a browser engine. I like rust, I like the sensibilities. Maybe my experience is too limited to higher level problems though. There's plenty of room for the likes of Go, Java and C# is all I'm getting at.
      - josephg 3y ago
        Yeah I think I broadly agree with you. Not many applications need rust's performance. Go, Java, C#, nodejs, python, etc are all great languages. But the software which does need or want "native performance" is incredibly important software. I'd use rust for things like databases, operating systems, web browsers, high performance web servers, network services (samba, ssh), and other "systems" software like that. Most of the lines of code ever written are probably in application code. If you're making a company website, python or C# or whatever is totally fine. But a remarkable proportion of the lines of code your computer actually runs were written in C or C++. Your web server might be in python, but if you use nginx as a proxy - well, thats C++ (I think). Use postgres? C++. Running your software in linux? C. Testing with Chrome? C++. What is python itself written in? I dunno, but I bet its either C or C++. You get the picture. Whether or not rust is a big deal is largely a matter of focus.
LtWorf 3y ago
So you're saying there is no CVE in php, java, go, js, and python?
- josephg 3y ago
  In their defence, there are entire classes of security bugs that memory safe languages protect you from. A large percentage of the security bugs in Chrome, OpenSSL, iMessage and lots of other apps wouldn’t have happened in any of the languages you listed. Or, almost certainly, in Rust.
  - Xeamek 3y ago
    And how many of such bugs could be prevented with compiler warnings and flags?
    - tracker1 3y ago
      If you're going to start writing it testing or C++ like Rust or follow certain guidelines, a lot of them. But if you're going to constrain how you do things, why not use a language that also gives you higher level functionality along the way?
      - Xeamek 3y ago
        I agree. My point is that I just feel like "but someone please think of the ̶ ̶c̶h̶i̶l̶d̶r̶e̶n̶ memory safety" argument is over blown. There are ways to eliminate majority of those issues in cpp as well, but people simply don't care. If You want to use Rust because it's just better language - go for it, I do it as well. But let's actually use that as an argument, instead of hiding behind superficial ones
        josephg 3y ago
        > There are ways to eliminate majority of those issues in cpp as well, but people simply don't care. If its that easy, why do Google, Apple, Microsoft and basically everyone else keep making memory safety related bugs? Are they all just idiots? Do you think they just don't care about security? Carmack found C++ static analysis tools found mountains of latent bugs in the quake source code - despite the game running great. Personally I find it a very arrogant statement to claim that memory safety in C++ is easy. If google finds it hard, despite throwing millions each year into the problem, I'm of a mind to believe them.

josephg 3y ago

As uncomfortable as this is to say, the existence of latent security vulnerabilities doesn’t seem to stop people from shipping a lot of apparently working code in C and C++. And I don’t think a lot of those CVEs come from people misunderstanding the languages. As I understand it they mostly come from honest software bugs. C++ makes it easy for honest mistakes by experts to become security nightmares. This is a controversial opinion - but I think the fault is in C and C++ themselves. Not the programmers who need to work even harder such that they stop ever making mistakes.

vacuity 3y ago
Which is why some people push for no longer using C and C++ as much as possible. It's just not feasible to expect the average programmer to avoid all the security pitfalls. Of course, whether Rust is the best option isn't a given.
- josephg 3y ago
  There aren’t a lot of memory safe options if you want the kind of performance rust offers. Rust is fine, but it’s far from perfect. It’s hard to learn, complex, and the macro and async systems are honestly a bit of a mess. I’m really looking forward to whatever comes after rust. I’m hoping some bright sparks out there manage to make a language with rust’s memory safety but that cleans up some of rust’s rough edges.
  - tracker1 3y ago
    To be fair, how many applications really need Rust's level of performance? I mean operating system code and drivers... But, many apps are getting the job done in electron with a browser engine. I like rust, I like the sensibilities. Maybe my experience is too limited to higher level problems though. There's plenty of room for the likes of Go, Java and C# is all I'm getting at.
    - josephg 3y ago
      Yeah I think I broadly agree with you. Not many applications need rust's performance. Go, Java, C#, nodejs, python, etc are all great languages. But the software which does need or want "native performance" is incredibly important software. I'd use rust for things like databases, operating systems, web browsers, high performance web servers, network services (samba, ssh), and other "systems" software like that. Most of the lines of code ever written are probably in application code. If you're making a company website, python or C# or whatever is totally fine. But a remarkable proportion of the lines of code your computer actually runs were written in C or C++. Your web server might be in python, but if you use nginx as a proxy - well, thats C++ (I think). Use postgres? C++. Running your software in linux? C. Testing with Chrome? C++. What is python itself written in? I dunno, but I bet its either C or C++. You get the picture. Whether or not rust is a big deal is largely a matter of focus.

LtWorf 3y ago

So you're saying there is no CVE in php, java, go, js, and python?

josephg 3y ago
In their defence, there are entire classes of security bugs that memory safe languages protect you from. A large percentage of the security bugs in Chrome, OpenSSL, iMessage and lots of other apps wouldn’t have happened in any of the languages you listed. Or, almost certainly, in Rust.
- Xeamek 3y ago
  And how many of such bugs could be prevented with compiler warnings and flags?
  - tracker1 3y ago
    If you're going to start writing it testing or C++ like Rust or follow certain guidelines, a lot of them. But if you're going to constrain how you do things, why not use a language that also gives you higher level functionality along the way?
    - Xeamek 3y ago
      I agree. My point is that I just feel like "but someone please think of the ̶ ̶c̶h̶i̶l̶d̶r̶e̶n̶ memory safety" argument is over blown. There are ways to eliminate majority of those issues in cpp as well, but people simply don't care. If You want to use Rust because it's just better language - go for it, I do it as well. But let's actually use that as an argument, instead of hiding behind superficial ones
      - josephg 3y ago
        > There are ways to eliminate majority of those issues in cpp as well, but people simply don't care. If its that easy, why do Google, Apple, Microsoft and basically everyone else keep making memory safety related bugs? Are they all just idiots? Do you think they just don't care about security? Carmack found C++ static analysis tools found mountains of latent bugs in the quake source code - despite the game running great. Personally I find it a very arrogant statement to claim that memory safety in C++ is easy. If google finds it hard, despite throwing millions each year into the problem, I'm of a mind to believe them.