I agree with this assessment of the C++20 lifetimes stuff. It's great, it will probably catch a lot of bugs, but it doesn't catch the worst ones and that's where you need it the most.
* CPU time per request: we do more work than we used to on average. For example, we do more asymmetric cryptographic operations now, and since introducing those operations we've increased the lengths of the keys. CPU time per request contributes not only to cost but to user-facing latency.
* overall request rate: we handle >256X as many requests as we did 12 years ago.
Those reasons are particular to my service, but I'd say the continued usage of C++ is convincing proof that plenty of people are willing to go to considerable effort to improve latency and efficiency. It'd be a lot easier to write things in a higher-level, GCed language otherwise.
> We introduce a new approach for implementing cryptographic arithmetic in short high-level code with machine-checked proofs of functional correctness. We further demonstrate that simple partial evaluation is sufficient to transform into the fastest-known C code, breaking the decades-old pattern that the only fast implementations are those whose instruction-level steps were written out by hand.
> These techniques were used to build an elliptic-curve library that achieves competitive performance for 80 prime fields and multiple CPU architectures, showing that implementation and proof effort scales with the number and complexity of conceptually different algorithms, not their use cases. As one outcome, we present the first verified high-performance implementation of P-256, the most widely used elliptic curve. Implementations from our library were included in BoringSSL to replace existing specialized code, for inclusion in several large deployments for Chrome, Android, and CloudFlare.
Could you use session keys to take some of the load off, exchanged using asymmetric crypto, or are you already doing that?
Also, cool thing about Rust is that you can start writing parts of a C or C++ code base in Rust, and slowly switch over. This is exactly what Firefox is doing with their browser. Could you convince your company to let you try to rewrite a small part in Rust?
And no matter how much I'd love to, rewriting in Rust at work is not gonna happen any time soon. There's tons of support built up for the major languages in terms of build tools, IDEs, code cross-referencing, automated refactoring, style guides, libraries, etc. It's understandably a difficult process to get a language added to that list.
Besides, my team struggles to find time to just modernize our C++. I wouldn't want to start converting to another language until I find time/staffing to actually commit to carrying through. And I know from trying it at home that rewriting a project in Rust takes me longer than expected and bindgen's C++ compatibility is less than perfect.
So I get my Rust fix with personal projects instead (when I can find time).
I don't usually write negative comments about C++ but I sure sympathize with them.
I write C++ at my day job (and have for years). My team's codebase is in its teenage years. It's code-reviewed and has decent test coverage, but in many cases the author doesn't know C++ as well as the reviewer, and the reviewer is rushed / trying to not be a huge bottleneck, so stuff slips through. New code gets written to mostly C++11 standards (soon, mostly C++17) and the newest company practices. Old code...still exists...and the new code still has to use it. We've modernized some pieces but not as much as we'd like. Company-wide people do a pretty good job of modernizing a lot of the libraries we use, but my team hasn't kept up as well for various reasons.
I hate memory errors. They're super hard to track down. I've spent significant time doing so. Thank god for ASAN and TSAN at least.
I also don't like crashes in general; my service has to be quite reliable (some operations are critical to big parts of the company and have a 99.9995% success within a certain deadline). And fast, so I can't just rewrite it in Java or Go.
A few examples of the sort of foot-guns C++ has:
* Data races: no equivalent of Rust's Send+Sync auto traits.
* string_view/reference/pointer outliving their backing memory: no lifetime annotations. Even the new proposal for them is very incomplete.
* std::optional and equivalents dereferenced incorrectly: no pattern-matching syntax, the decision for the most obvious way to deference (operator*) to be undefined behavior instead of a crash.
I wish the whole thing were written in Rust. Then the parts I have to pay super close attention to would all say "unsafe" in them. That covers memory safety (including data races). I'd also know to pay pretty close attention to "expect" and "unwrap", which cover most (not all) panics. Of course, more mundane logic errors can exist in any language, but freedom from those problems would be a huge relief.