Microsoft and Google are trying to retrofit a safe subset into C++, via the Core Guidelines and lifetimes, enforced via static analysers.

Since C++ is more relevant to what I do, naturally I keep validating how good they fair and so far not good.

Lifetimes checker for example, is only able to deal with basic workflows and when it complains the error messages aren't that good, leaving you wonder why the analyser considered it an incorrect lifetime.

Main reason being, if the call sites aren't annotated, it can only guess the lifetime use, and mostly it gets it wrong.

No doubt if they keep throwing money at it, they might eventually solve it, however this is already a three year effort and this is the best so far.