Rust newcomers are 70x less likely to create vulnerabilities than C++ newcomers [pdf]

Re:Rust newcomers are 70x less likely to create vulnerabilit... by baq on Tuesday November 07, 2023 @08:26AM (#38176452)

But C is anything but simple! It's small but it's so full of undefined behaviors it requires considerable knowledge and experience to stay within the bounds of 'predictable'. It's better nowadays if you are taught to enable all possible warnings and even then you'd better use a static analyzer and valgrind for anything more than hello world.

Python's hiding of memory is a feature when teaching beginners programming IMHO unless you want to start teaching close to the metal. I prefer to start from the algorithmic CS-y side.

[ Parent | on HN ]

Re:Rust newcomers are 70x less likely to create vulnerabilit... by usrbinbash on Tuesday November 07, 2023 @08:48AM (#38176642)

> it requires considerable knowledge and experience to stay within the bounds of 'predictable'

No it really doesn't. Initialize all variables, always check boundaries and free memory when you're done with it. That about covers 90% of it.

Yes, this becomes more difficult the less trivial the codebase becomes. But beginners don't have non-trivial codebases, and teaching these concepts isn't hard.

> Python's hiding of memory is a feature when teaching beginners programming IMHO unless you want to start teaching close to the metal. I prefer to start from the algorithmic CS-y side.

And I prefer to start from the systems-programming, practical side. And in the practical world, memory isn't some abstract thing that may or may not exist, function calls cause overhead, strict typing is a friend, and networks fail.

So yes, teaching a bit closer to the metal has its advantages.

[ Parent | on HN ]