3 ms·
That C isn't predictable or well-specified, which is a real problem when writing portable or secure code ("oh shit" moments in C code don't just give programmer
by ahomescu1 12y ago
That C isn't predictable or well-specified, which is a real problem when writing portable or secure code ("oh shit" moments in C code don't just give programmers headaches, but have caused tons of vulnerabilities).
- mtdewcmu 12y agoNot predictable or well-specified in comparison to what? Buffer overflows are not caused by the language. They are a well-known risk of developing in native code. Well-known risks are not surprises. Part of being unsurprising is being one of the oldest and most popular programming languages. There's no excuse for being surprised by what's well known.
- ahomescu1 12y agoIn comparison to Java, for example. Java specifies integer and float semantics exactly, including what happens for things like over/underflow and division by zero. C leaves too much to be decided by the compiler writer or ABI. Buffer overflows aren't the only problem C has. For an interesting discussion and examples of bad behavior that C allows, please take a look at [1] (especially part 2 of that series) and [2] (yes, some of these are compiler shenanigans; the problem is that the C standard allows the compiler to go crazy). 1 - http://blog.llvm.org/2011/05/what-every-c-programmer-should-know.html http://blog.llvm.org/2011/05/what-every-c-programmer-should-... 2 - http://blog.regehr.org/archives/213 http://blog.regehr.org/archives/213