4 ms·

> Improving safety has been an aim of C++ from day one and throughout its evolution. Just compare the K&R C language with the earliest C++, and the early C++ wi

> Improving safety has been an aim of C++ from day one and throughout its evolution. Just compare the K&R C language with the earliest C++, and the early C++ with contemporary C++. My CppCon 2023 keynote outlines that evolution, C++ safety may have improved a lot, but it’s still far, far behind most other languages we use. It’s not even a close comparison. You throw a bunch of programmers at a problem and you will get some number of bugs in the code. In C++, some percentage of those bugs will be memory errors. You can eliminate raw pointers but that doesn’t solve the problem—there are all sorts of places that dangling pointers crop up anyways, like in references that get captured in lambdas which get stored somewhere and then the programmer doesn’t realize that the lambda is called after the object is destroyed. I’ve seen various solutions proposed to these problems. The worst solution is to “just hire better programmers and be careful”. The easiest solution for greenfield projects, most of the time, is to pick a different language.

amluto 3y ago
I admit I mostly don’t understand the “modern C++ is safe” argument. I maintain a decent size C++ code base, I try to use modern features in good taste, and I do think that C++ has added a lot of nice things. But nice != safe. basic_string_view is new in C++17. It sure beats pointers, but it’s a far cry from the kind of safety that you get in essentially any other language (except C): it is a reference with unknown lifetime, and the toolchain does not help track that lifetime. I think that Stroustrup would say that the C++ Core Guidelines fix this, and I think he’s referring to this: https://github.com/isocpp/CppCoreGuidelines/blob/master/docs/Lifetime.pdf https://github.com/isocpp/CppCoreGuidelines/blob/master/docs... which seems like it’s maybe partly implemented in some version of Visual Studio and was maybe prototyped in clang. But it does not seem to be a well-specified language or a fully-implemented language, and I can’t use it now. So, as far as I’m concerned, I can use Rust or Python or Perl or Go or Swift or bash or Java or JavaScript or Haskell or Lisp or Scheme or O’Caml or Tcl and I can manipulate strings without worrying about undefined behavior. Or I can use C++ and worry. Or I can dream about using “Modern C++?”
- kazinator 3y ago
  C++ is safe if you ignore most of its libraries and write everything from scratch, making safety your #1 priority, ahead of performance and everything else, and then doggedly stick to using nothing but the safe primitives you have created.
  - ptx 3y ago
    Safe primitives such as garbage collection?
  - amluto 3y ago
    I guess you had better never use a class template, then, because that typename T parameter and associated member of type T is polymorphic over whether it is a reference or pointer to a value owned elsewhere.
    - kazinator 3y ago
      How you instantiate a template is under your control (except when it's a decision in a legacy codebase you've inherited).
      - amluto 3y ago
        This sounds like the standard under which C is safe because I, personally, don’t make mistakes. If foo<string> is fine but foo<string_view> compiles successfully, generates no warnings, but is nonetheless UB and accesses a dangling pointer that merely usually still contains the expected value, then the overall programming environment is not safe. C++, as it exists today, makes it very very difficult to build a safe system while still using most of the features that make C++ worth using. Every other language I have as an example has an ecosystem in which one can pass values around such that the semantics are actually defined for any remotely reasonable program that can be executed. The GC and automated-reference-counted languages keep values alive (although Python does struggle to make it clear whether one has captured an immutable value or a remotely mutable reference). The languages that don’t really have references (e.g. bash) copy values as needed. Rust says “you have full control as to how you instantiate things, but you must prove to the compiler that you did it right, and I will steer you toward patterns that make this relatively painless.” C++ has none of this.

amluto 3y ago

I admit I mostly don’t understand the “modern C++ is safe” argument. I maintain a decent size C++ code base, I try to use modern features in good taste, and I do think that C++ has added a lot of nice things. But nice != safe. basic_string_view is new in C++17. It sure beats pointers, but it’s a far cry from the kind of safety that you get in essentially any other language (except C): it is a reference with unknown lifetime, and the toolchain does not help track that lifetime. I think that Stroustrup would say that the C++ Core Guidelines fix this, and I think he’s referring to this: https://github.com/isocpp/CppCoreGuidelines/blob/master/docs/Lifetime.pdf https://github.com/isocpp/CppCoreGuidelines/blob/master/docs... which seems like it’s maybe partly implemented in some version of Visual Studio and was maybe prototyped in clang. But it does not seem to be a well-specified language or a fully-implemented language, and I can’t use it now. So, as far as I’m concerned, I can use Rust or Python or Perl or Go or Swift or bash or Java or JavaScript or Haskell or Lisp or Scheme or O’Caml or Tcl and I can manipulate strings without worrying about undefined behavior. Or I can use C++ and worry. Or I can dream about using “Modern C++?”

kazinator 3y ago
C++ is safe if you ignore most of its libraries and write everything from scratch, making safety your #1 priority, ahead of performance and everything else, and then doggedly stick to using nothing but the safe primitives you have created.
- ptx 3y ago
  Safe primitives such as garbage collection?
- amluto 3y ago
  I guess you had better never use a class template, then, because that typename T parameter and associated member of type T is polymorphic over whether it is a reference or pointer to a value owned elsewhere.
  - kazinator 3y ago
    How you instantiate a template is under your control (except when it's a decision in a legacy codebase you've inherited).
    - amluto 3y ago
      This sounds like the standard under which C is safe because I, personally, don’t make mistakes. If foo<string> is fine but foo<string_view> compiles successfully, generates no warnings, but is nonetheless UB and accesses a dangling pointer that merely usually still contains the expected value, then the overall programming environment is not safe. C++, as it exists today, makes it very very difficult to build a safe system while still using most of the features that make C++ worth using. Every other language I have as an example has an ecosystem in which one can pass values around such that the semantics are actually defined for any remotely reasonable program that can be executed. The GC and automated-reference-counted languages keep values alive (although Python does struggle to make it clear whether one has captured an immutable value or a remotely mutable reference). The languages that don’t really have references (e.g. bash) copy values as needed. Rust says “you have full control as to how you instantiate things, but you must prove to the compiler that you did it right, and I will steer you toward patterns that make this relatively painless.” C++ has none of this.