News for hackers. Stuff that matters.
Re:It’s time to kill the web app by MikeHolman on Saturday September 23, 2017 @05:45PM (#15321929)
C and C++ are definitely not as secure as a language with automatic memory management. OOB reads/writes, type confusion, and UAF are all very real problems in C and C++.

Static analysis helps, but it can't catch everything. I work on a modern C++ codebase, and we still face all of these issues.

Formal verification is infeasible for most software projects, but they can get guaranteed type/memory safety by using a language proven to be safe. C/C++ can't give you that, but JavaScript might be able to.

Re:It’s time to kill the web app by gens on Saturday September 23, 2017 @06:18PM (#15322088)
Not as secure, but nowhere near the death traps as some(many?) describe them.

Things that are written in C these days are usually written in C for performance reasons. FFMPEG would not have even close to the performance it has if it was written in a memory safe language instead of C and assembly. I doubt that a magical compiler (and/or language) will appear in my lifetime that can compile high level code into performant machine code, especially when it comes to memory management. (note that C also has advantages other then performance)

JS doesn't even have a proper specification, let alone a bug-free interpreter/compiler.

EDIT: AFAIK verifying memory access is part of a formal verification, where memory is also modeled mathematically.