Chromium project finds that 70% of security defects are memory safety problems

Re:Chromium project finds that 70% of security defects are m... by SomeoneFromCA on Sunday May 24, 2020 @02:07PM (#23293312)

The real point of using C and (less so, but still) C++ is not to have the ultimate performance, but to have ultimate control over the program execution. Garbage collection and real-time code are not compatible, because GC introduces random, unexpected stalls in the program flow; even simple reference counting can be harmful, if the last reference get eliminated in the wrong time, and creates a cascade of deallocations.

[ Parent | on HN ]

Re:Chromium project finds that 70% of security defects are m... by pjmlp on Monday May 25, 2020 @02:34AM (#23298577)

Then using C and C++ is a mistake, because there isn't an ultimate control about how memory allocator interacts with the OS.

So much that in the 90's there were vendors that could make a business out of selling specialized memory allocators.

[ Parent | on HN ]

Re:Chromium project finds that 70% of security defects are m... by SomeoneFromCA on Monday May 25, 2020 @07:39AM (#23300068)

Really? What about an OS kernel code? How does "it's allcator" interacts "with the OS"? And what these allocators were written in?

[ Parent | on HN ]

Re:Chromium project finds that 70% of security defects are m... by pjmlp on Monday May 25, 2020 @08:13AM (#23300215)

Usually in a mix of Assembly and whatever is used in OS systems implementation language, not necessarily C.

https://inf.ethz.ch/personal/wirth/ProjectOberon/Sources/Ker...

The malloc() exposed in a ISO C standard library implementation isn't necessarily related to whatever means the OS does memory allocation.

[ Parent | on HN ]