Most languages are memory safe. Literally every language with a GC is. C and C++ are pretty much the only 2 languages that are not memory safe by default.

Go is famously not memory safe. Not only can you trivially create data races, if you data race on an interface fat pointer then you can corrupt its vtable (entirely in "safe" code; no `unsafe.Pointer`).

It is of course better at memory safety than C and C++, but these issues do come up in real deployments.

Good thing Go has a race detector!

and C++ doesn't?

Data races aren’t memory unsafe. The vtable thing is, but at least that’s accidental.

Data races have nothing to do with memory safety. Please do not conflate these two. Java, C#, Go, etc. can all have data races, but they are all memory safe languages.

Golang permits safe code to use a data race to cause type confusion and violate memory safety though.

Go is memory safe, data races are inherent to all languages beside Rust? As for interface fat pointer it's a none issue in real life code.

https://research.swtch.com/gorace

"Only 2" is very short-sighted, there's also Assembler, Pascal, Ada, Objective-C...

One general comment: it's kind of funny to see a C library being bashed right away at V1.0. As far as I can tell, nghtpp2 isn't even a CVE nest to begin with [1]. Some people must be desperate for "easy" targets.

[1] https://www.cvedetails.com/vendor/15772/Nghttp2.html

I’ve never written a line of Rust in my life. Though as a user of computers I have an interest in software being secure, especially an HTTP client which I may at some point be subject to. I’ve been a developer for a long enough time, worked with enough developers, and written enough C (not much), to have formed the strong belief that: C’s typical use is not memory-safe due to completely understandable human error, these footguns do not justify its use in most greenfield contexts, and any developer that denies the existence of these footguns has bought into a delusion that I can’t even begin to understand.

I don’t care if it’s Rust or something else. The fact that this completely legitimate and long-proven drawback of C is always met with “Rust fanboy!” comments speaks volumes, and not about ‘Rust people’. It’s incredibly disappointing that this is where we’re at with these sorts of discussions. Comments that essentially amount to “fake news!” and reject any premise of a shared reality.