News for hackers. Stuff that matters.

A comment on Chromium project finds that 70% of security defects are memory safety problems. Parent comment

Re:Chromium project finds that 70% of security defects are m... by Groxx on Sunday May 24, 2020 @05:29AM (#23290341)
Similar to C++ though, e.g. explosions of template expansions, you don't have to use those higher-level and harder-to-keep-concise features. Other fancy languages have stable ABIs, it's not impossible, nor does it require that it's complex to use.

Though the average one is probably harder, yes. I'd wager that it's mostly lack of care or motivation though, made a bit worse by common language features.

[ Parent | on HN ]
Re:Chromium project finds that 70% of security defects are m... by adev_ on Sunday May 24, 2020 @06:31AM (#23290583)
> Similar to C++ though, e.g. explosions of template expansions, you don't have to use those higher-level and harder-to-keep-concise features.

C++ has a stable ABI. Fragile, but stable. Or doing things like updating libQt on your Linux distribution without recompiling half of the world would be close to impossible :)

[ Parent | on HN ]
Re:Chromium project finds that 70% of security defects are m... by amaranth on Sunday May 24, 2020 @11:51AM (#23292355)
This is a relatively new feature and there have been one or two ABI breaks since they thought it was done that required recompiling half the world. I think it's been solid for at least most of the last decade though so... stable enough? I'm not sure if there is an actual spec somewhere though, certainly not a proper one from a standards body. It's just "whatever GCC or MSVC do on that OS/CPU combo" and those two happen to have stopped changing the ABI every compiling release at some point. They're both at least based on the relatively well specified Itanium C++ ABI though so that helps.
[ Parent | on HN ]
Re:Chromium project finds that 70% of security defects are m... by Groxx on Monday May 25, 2020 @01:46AM (#23298267)
C++ is also older than Rust by, oh... a few years.

I'm not aware of any plan to not stabilize Rust's ABI, it just hasn't happened yet. It's completely fair to label that a deal-breaker for using Rust, but trying to draw a hypothetical box around it with the label "its ABI will be difficult to create and/or use" seems a bit unwarranted.

[ Parent | on HN ]