3 ms·

> Rust can't guarantee shit And yet, the Rust community takes it seriously, issuing a CVE, a point release and a blog post. You won't find these 3 from all 3 m

> Rust can't guarantee shit And yet, the Rust community takes it seriously, issuing a CVE, a point release and a blog post. You won't find these 3 from all 3 major C++ implementations (clang, gcc and msvc) because they don't take the issue as seriously because their spec says they don't have to. Rust can't guarantee shit but at least they do shit when there's a problem. They take accountability for their shit. You keep harping on minor nitpicks, but you can't escape the fact that the C++ community did not take this issue as seriously as Rust did. Therefore it is meaningless to compare CVEs across the two ecosystems, which was the substance of the top level comment.

kllrnohj 3y ago
> because they don't take the issue as seriously because their spec says they don't have to. And yet they all quickly fixed the issue and nobody tried to hide behind "the spec" Should there have been a CVE? Probably. But there's no central C++ CVE committee to have done that, either, which to Herb's point there probably should be. Should there have been a blog post? Probably not. People don't ship their own standard library, so the blog post is low value. What matters is whether or not distros/OS's picked up that fix promptly. Which unfortunately is hard to find out since most Linux distros suck ass at keeping their standard libraries up to date.
- nindalf 3y ago
  > they all quickly fixed the issue I notice you linked the fixes for clang and gcc. Where's the link for MSVC? > Should there have been a CVE? Probably. Glad you agree. But the absence of it proves the point I'm trying to make - they didn't take it seriously enough. > there's no central C++ CVE committee to have done that, either, which to Herb's point It actually sounds like Herb wants to reduce the the number of C++ CVEs that are filed, not increase them. He very specifically says that a bug shouldn't be enough, there should be a vulnerability. It sounds like he wants to achieve his goal of fewer CVEs by juking the stats, but who knows.

kllrnohj 3y ago

> because they don't take the issue as seriously because their spec says they don't have to. And yet they all quickly fixed the issue and nobody tried to hide behind "the spec" Should there have been a CVE? Probably. But there's no central C++ CVE committee to have done that, either, which to Herb's point there probably should be. Should there have been a blog post? Probably not. People don't ship their own standard library, so the blog post is low value. What matters is whether or not distros/OS's picked up that fix promptly. Which unfortunately is hard to find out since most Linux distros suck ass at keeping their standard libraries up to date.

nindalf 3y ago
> they all quickly fixed the issue I notice you linked the fixes for clang and gcc. Where's the link for MSVC? > Should there have been a CVE? Probably. Glad you agree. But the absence of it proves the point I'm trying to make - they didn't take it seriously enough. > there's no central C++ CVE committee to have done that, either, which to Herb's point It actually sounds like Herb wants to reduce the the number of C++ CVEs that are filed, not increase them. He very specifically says that a bug shouldn't be enough, there should be a vulnerability. It sounds like he wants to achieve his goal of fewer CVEs by juking the stats, but who knows.