Re:Nghttp3 1.0.0 – HTTP/3 library written in C
by adgjlsfhk1 on Saturday October 21, 2023 @11:07PM
(#37972479)
Most languages are memory safe. Literally every language with a GC is. C and C++ are pretty much the only 2 languages that are not memory safe by default.
[ Parent
| on HN ]
Re:Nghttp3 1.0.0 – HTTP/3 library written in C
by tczMUFlmoNk on Sunday October 22, 2023 @12:03AM
(#37972729)
Go is famously not memory safe. Not only can you trivially create data races, if you data race on an interface fat pointer then you can corrupt its vtable (entirely in "safe" code; no `unsafe.Pointer`).
It is of course better at memory safety than C and C++, but these issues do come up in real deployments.
Re:Nghttp3 1.0.0 – HTTP/3 library written in C
by zakkor1 on Sunday October 22, 2023 @04:52AM
(#37973866)
Good thing Go has a race detector!
Re:Nghttp3 1.0.0 – HTTP/3 library written in C
by mgaunard on Sunday October 22, 2023 @06:13AM
(#37974151)
and C++ doesn't?
Re:Nghttp3 1.0.0 – HTTP/3 library written in C
by dontlaugh on Sunday October 22, 2023 @05:31AM
(#37973996)
Data races aren’t memory unsafe. The vtable thing is, but at least that’s accidental.
Re:Nghttp3 1.0.0 – HTTP/3 library written in C
by mseepgood on Sunday October 22, 2023 @05:35AM
(#37974011)
Data races have nothing to do with memory safety. Please do not conflate these two. Java, C#, Go, etc. can all have data races, but they are all memory safe languages.
Re:Nghttp3 1.0.0 – HTTP/3 library written in C
by anonymoushn on Sunday October 22, 2023 @07:21AM
(#37974422)
Golang permits safe code to use a data race to cause type confusion and violate memory safety though.
Re:Nghttp3 1.0.0 – HTTP/3 library written in C
by Thaxll on Sunday October 22, 2023 @08:41AM
(#37974855)
Go is memory safe, data races are inherent to all languages beside Rust? As for interface fat pointer it's a none issue in real life code.
Re:Nghttp3 1.0.0 – HTTP/3 library written in C
by astrobe_ on Sunday October 22, 2023 @10:00AM
(#37975457)
"Only 2" is very short-sighted, there's also Assembler, Pascal, Ada, Objective-C...
One general comment: it's kind of funny to see a C library being bashed right away at V1.0. As far as I can tell, nghtpp2 isn't even a CVE nest to begin with [1]. Some people must be desperate for "easy" targets.