Top secure C++ coding practices

Re:Top secure C++ coding practices by ridiculous_fish on Wednesday March 16, 2022 @09:10PM (#30706307)

Old codebases have a lot of baked-in institutional knowledge and bug fixes. A RiiR effort will introduce new bugs and reintroduce old ones, especially if done "without the full context, hastily, and by people who did not write the original code." Rewrites often fail.

MSFT, Google, Apple, Facebook all have a gazillion lines of C++ and it's not going away any time soon. "Don't use C++" is not practical advice for them and many other companies.

[ Parent | on HN ]

Re:Top secure C++ coding practices by pjmlp on Thursday March 17, 2022 @05:03AM (#30709053)

Microsoft Security Response Center official guidelines are:

1 - Use a managed language like C#, Java, Go if automatic memory management is ok

2 - Use a systems language like Rust if automatic memory management is not an option

3- Use C++ alongside Core Guidelines tooling.

Granted, not all Microsoft projects care about those guidelines.

[ Parent | on HN ]