4 ms·

I love how in C++ there seems to be this security issue, and now hundreds of people try to come up with different ways on how to tackle the problem. Everybody

I love how in C++ there seems to be this security issue, and now hundreds of people try to come up with different ways on how to tackle the problem. Everybody wants to help and spend their free time on it. You don't see this in other languages so much. People just use those languages and "they" have to fix any flaws. Also keep your bingo cards ready for people saying Rust does not have undefined behaviour. I'm also not so sure Rust is even that safe. Yes it's memory safe but the languages with the most vulnerabilities is not C++. It's PHP, .NET, C, Java, JavaScript. C++ is not an unsafe language. You can't make a language safe by adding an "unsafe" keyword end expect everything outside it to be safe. Else .NET and Java would be lower on the list than C++ because they do have bounds checks and they don't have raw pointers. It's a bit of a false sense of security and a play of words this "unsafe" keyword in Rust.

theragra 3y ago
You have data to confirm your claims? Moreover, vulnerabilities in languages themselves are not that important in comparison to vulnerabilities in software written in the specific language, at least how I understand this.
- wbkang 3y ago
  I don't have solid data but for "core" mature software written in c/c++ like browsers and Linux, I feel like I see far more high profile security bugs from the lack of memory safety rather than something like "Linux failed to enforce the existing permissions".
n2d4 3y ago
> You don't see this in other languages so much. People just use those languages and "they" have to fix any flaws. You absolutely do see that elsewhere, and that's why here on HN we have a different new JS framework every day. The safety in Rust (and .NET, and Java) doesn't come from the `unsafe` keyword, it comes from the guarantees that you have when you don't use said keyword. Ownership, garbage collectors, and less undefined behaviour are some reasons why those languages are considered safer. At the end, memory safety is a spectrum, and while you can still break Rust's (or even Java's) memory model, it's much harder to do so unintentionally. That's a win. Even if there are some undefined edge cases!
- jurschreuder 3y ago
  That sounds great, and that's the narrative you constantly hear. Java, .NET are memory safe. BUT: they all have more vulnerabilities on average than C++. So just saying, memory safety alone does almost nothing to make a language safe. Why would Rust be so much safer than C++ if so almost all other languages also have memory safety but are on average less safe than C++? Meaning more vulnerabilities (so not only memory safety just to be very clear)
metaltyphoon 3y ago
Do tou have data to back up these claims?

theragra 3y ago

You have data to confirm your claims? Moreover, vulnerabilities in languages themselves are not that important in comparison to vulnerabilities in software written in the specific language, at least how I understand this.

wbkang 3y ago
I don't have solid data but for "core" mature software written in c/c++ like browsers and Linux, I feel like I see far more high profile security bugs from the lack of memory safety rather than something like "Linux failed to enforce the existing permissions".

n2d4 3y ago

> You don't see this in other languages so much. People just use those languages and "they" have to fix any flaws. You absolutely do see that elsewhere, and that's why here on HN we have a different new JS framework every day. The safety in Rust (and .NET, and Java) doesn't come from the `unsafe` keyword, it comes from the guarantees that you have when you don't use said keyword. Ownership, garbage collectors, and less undefined behaviour are some reasons why those languages are considered safer. At the end, memory safety is a spectrum, and while you can still break Rust's (or even Java's) memory model, it's much harder to do so unintentionally. That's a win. Even if there are some undefined edge cases!

jurschreuder 3y ago
That sounds great, and that's the narrative you constantly hear. Java, .NET are memory safe. BUT: they all have more vulnerabilities on average than C++. So just saying, memory safety alone does almost nothing to make a language safe. Why would Rust be so much safer than C++ if so almost all other languages also have memory safety but are on average less safe than C++? Meaning more vulnerabilities (so not only memory safety just to be very clear)

metaltyphoon 3y ago

Do tou have data to back up these claims?