I have to disagree; for the case of parsers, we must go to enormous effort to program them in languages that make it difficult to parse them safely. Safe parsing in this case is pretty much just being buffer/array-safe, nothing really fancy. Pretty much the only extant language in which the simple act of parsing files is dangerous is C, or non-idiomatic C++ being used as "super C".

If you're writing security code, put down the damn C.

(I mean, my personal opinion is just flat-out put down the damn C anyhow; even non-"security code" has a way of turning into security-sensitive code when you're not looking. But certainly if you're writing security code.)

I think x0x0 actually agrees with you here..

This is one of the big reasons Rust is so exciting. ABI compatibility with C and no real runtime (no GC etc.).

Though Kapersky would have been better off even using C++/CLI and "It Just Works" to hook into code written in, say, C#. The IJW stuff is cute, as it seamlessly brings the CLR in-process and lets you transition from native to managed without noticing. (And MSVC's C++->CLI targeting is good enough to compile MS Office except producing MSIL instead of native code, fwiw.)

so it's easy enough and fast to have c++ calling rust, so you can spot replace pieces of an extant codebase?

Yes. And that’s what mozilla has started to do recently.

Any idea where I can find such commits?

They aren't checked in yet, but https://bugzilla.mozilla.org/show_bug.cgi?id=1161350 has some patches (marked obsolete) and https://bugzilla.mozilla.org/show_bug.cgi?id=1151899 has a work-in-progress patch.

Nifty. Thanks for the links!

Yes, precisely.

Apart from obviously Rust, there's a subset of C++. One can, of course, do all of the insecure things in C++ that one does in C -- and more, in fact. This is not required, though: you can have bounds-checked "arrays" (vectors accessed with .at(), never operator[]), various types of managed pointer (from boost, or with C++11 the stdlib), and require variable initialization.

One of the big problems with C++ is that few people actually do this. It basically requires putting a linter into your build process, to check for C-isms and unsafe C++ behavior. Otherwise, people will use these things because they are easier.

My favorite thing about Rust is that it's carefully designed to make the safe things easier. It's much better if you need to go out of your way to do something dangerous than the outher way around.

> One of the big problems with C++ is that few people actually do this. It basically requires putting a linter into your build process, to check for C-isms and unsafe C++ behavior. Otherwise, people will use these things because they are easier.

Which is one reason, why although I like C++, I am happy to only use it in side project, and mostly settle with JVM/.NET stuff for work nowadays.

Most of the enterprise code bases I have seen on my career, are mostly C with Classes style and most companies don't use analyzers. I was quite happy when Clang introduction started to change the mentality in regard to analyzers.