11 ms·

And how many of such bugs could be prevented with compiler warnings and flags?

by Xeamek 3y ago

tracker1 3y ago
If you're going to start writing it testing or C++ like Rust or follow certain guidelines, a lot of them. But if you're going to constrain how you do things, why not use a language that also gives you higher level functionality along the way?
- Xeamek 3y ago
  I agree. My point is that I just feel like "but someone please think of the ̶ ̶c̶h̶i̶l̶d̶r̶e̶n̶ memory safety" argument is over blown. There are ways to eliminate majority of those issues in cpp as well, but people simply don't care. If You want to use Rust because it's just better language - go for it, I do it as well. But let's actually use that as an argument, instead of hiding behind superficial ones
  - josephg 3y ago
    > There are ways to eliminate majority of those issues in cpp as well, but people simply don't care. If its that easy, why do Google, Apple, Microsoft and basically everyone else keep making memory safety related bugs? Are they all just idiots? Do you think they just don't care about security? Carmack found C++ static analysis tools found mountains of latent bugs in the quake source code - despite the game running great. Personally I find it a very arrogant statement to claim that memory safety in C++ is easy. If google finds it hard, despite throwing millions each year into the problem, I'm of a mind to believe them.
    - Xeamek 3y ago
      >Do You think people just don't care about security Yes, people don't care nearly as much as we like to pretend in online debates
      - josephg 3y ago
        I partially agree with you. I think most security compromises are due to misconfigured mongodb databases, bad passwords and unpatched software staying unpatched for months or years. Things like that. Lots of B tier engineering companies get done by this stuff every year because they’re sloppy. But memory bugs in C++ seem genuinely hard even if you do care about the problem. Google and Apple have never (as far as I know) had customer data stolen by some trivial misconfiguration problem. They pay out a lot of money in bug bounties. Google recruits some of the world’s smartest people to look for security problems in their products. And I’m sure they pay a bomb for access to proprietary C++ static analysis tools. And yet, they apparently still can’t consistently write memory safe C++ code. So yeah, I think that writing bug free c++ at scale is hard even if you do care about it.
        LtWorf 3y ago
        Apple? The same company that forked the JVM and then was taking months to fix vulnerabilities for which exploits were readily available on the internet, and that had been fixed immediately on linux and windows? The same company that has had a stream of no click 0days in imessage, because they parse the messages outside of a sandbox, and patch the issue but not the larger issue of the no-sandbox? Yeah they don't care about security at all. It's mostly just a thing their marketing department talks about. I'm sure their R&D budget for it is quite limited given their size.
    - LtWorf 3y ago
      Fun fact: working at a large company doesn't make you smarter. In fact all the laid off people probably feel less smart then average for accepting to work somewhere that treated them like that.
josephg 3y ago
I suspect fewer than you think. At least in FAANG code. Google chrome has had a fair few CVEs over the years despite having a lot of the worlds best security researchers working full time looking for security vulnerabilities. I think someone has tried reading the compiler warnings. There’s an old story about John carmack running a new static analysis tool on the quake3 source code. The code worked well. The tool apparently found a huge list of issues in the code - including a massive pile of real bugs. Then he tried another static analysis tool and it found more real bugs. And so on. The story is well worth a read. This is a great takeaway: > This seems to imply that if you have a large enough codebase, any class of error that is syntactically legal probably exists there. C++ is really hard to do “right”, at any scale in a real team. http://www.sevangelatos.com/john-carmack-on-static-code-analysis/ http://www.sevangelatos.com/john-carmack-on-static-code-anal...

And how many of such bugs could be prevented with compiler warnings and flags?

by Xeamek 3y ago

And how many of such bugs could be prevented with compiler warnings and flags?

If you're going to start writing it testing or C++ like Rust or follow certain guidelines, a lot of them. But if you're going to constrain how you do things, why not use a language that also gives you higher level functionality along the way?

Xeamek 3y ago
I agree. My point is that I just feel like "but someone please think of the ̶ ̶c̶h̶i̶l̶d̶r̶e̶n̶ memory safety" argument is over blown. There are ways to eliminate majority of those issues in cpp as well, but people simply don't care. If You want to use Rust because it's just better language - go for it, I do it as well. But let's actually use that as an argument, instead of hiding behind superficial ones
- josephg 3y ago
  > There are ways to eliminate majority of those issues in cpp as well, but people simply don't care. If its that easy, why do Google, Apple, Microsoft and basically everyone else keep making memory safety related bugs? Are they all just idiots? Do you think they just don't care about security? Carmack found C++ static analysis tools found mountains of latent bugs in the quake source code - despite the game running great. Personally I find it a very arrogant statement to claim that memory safety in C++ is easy. If google finds it hard, despite throwing millions each year into the problem, I'm of a mind to believe them.
  - Xeamek 3y ago
    >Do You think people just don't care about security Yes, people don't care nearly as much as we like to pretend in online debates
    - josephg 3y ago
      I partially agree with you. I think most security compromises are due to misconfigured mongodb databases, bad passwords and unpatched software staying unpatched for months or years. Things like that. Lots of B tier engineering companies get done by this stuff every year because they’re sloppy. But memory bugs in C++ seem genuinely hard even if you do care about the problem. Google and Apple have never (as far as I know) had customer data stolen by some trivial misconfiguration problem. They pay out a lot of money in bug bounties. Google recruits some of the world’s smartest people to look for security problems in their products. And I’m sure they pay a bomb for access to proprietary C++ static analysis tools. And yet, they apparently still can’t consistently write memory safe C++ code. So yeah, I think that writing bug free c++ at scale is hard even if you do care about it.
      - LtWorf 3y ago
        Apple? The same company that forked the JVM and then was taking months to fix vulnerabilities for which exploits were readily available on the internet, and that had been fixed immediately on linux and windows? The same company that has had a stream of no click 0days in imessage, because they parse the messages outside of a sandbox, and patch the issue but not the larger issue of the no-sandbox? Yeah they don't care about security at all. It's mostly just a thing their marketing department talks about. I'm sure their R&D budget for it is quite limited given their size.
  - LtWorf 3y ago
    Fun fact: working at a large company doesn't make you smarter. In fact all the laid off people probably feel less smart then average for accepting to work somewhere that treated them like that.

josephg 3y ago

I suspect fewer than you think. At least in FAANG code. Google chrome has had a fair few CVEs over the years despite having a lot of the worlds best security researchers working full time looking for security vulnerabilities. I think someone has tried reading the compiler warnings. There’s an old story about John carmack running a new static analysis tool on the quake3 source code. The code worked well. The tool apparently found a huge list of issues in the code - including a massive pile of real bugs. Then he tried another static analysis tool and it found more real bugs. And so on. The story is well worth a read. This is a great takeaway: > This seems to imply that if you have a large enough codebase, any class of error that is syntactically legal probably exists there. C++ is really hard to do “right”, at any scale in a real team. http://www.sevangelatos.com/john-carmack-on-static-code-analysis/ http://www.sevangelatos.com/john-carmack-on-static-code-anal...