Re:Zcoin implementation bug enabled attacker to create over ...
by Taek on Tuesday March 07, 2017 @08:32AM
(#13810120)
Especially a security critical program, you really need to be using bug discovery tools as much as possible.
You might even find some zero days just by addressing all the warnings.
Re:Zcoin implementation bug enabled attacker to create over ...
by aij on Tuesday March 07, 2017 @11:25AM
(#13811646)
I think that's kind of OP's point... Use a more modern language that actually treats these kind of bugs (and many many others) as errors rather than as optional warnings.
There's a reason practically no one uses a memory-safe C++ implementation.
Re:Zcoin implementation bug enabled attacker to create over ...
by Shorel on Wednesday March 08, 2017 @03:59PM
(#13823733)
Not only that, but using different compilers will also cover more possible warnings.
You can have code without any warnings in clang, gcc and msvc++ compilers and it is probably better than code tested with only one compiler.
As a c++ developer I would nope the hell out of there or spend a month fixing the warnings - depending on pay. No way would I work with something in that state long term.
> until somebody gets to fix all warnings which are not bugs.
Code that is filled with ignored warnings generally gets worse, not better. Having little to no quality standards does that.