News for hackers. Stuff that matters.
Re:C++ creator rebuts White House warning by kstrauser on Monday March 18, 2024 @07:22PM (#39751255)
I don't like Java. Nothing about it appeals to me. It pains my eyes to look at it.

And in spite of my distaste for it, I respect that it completely eliminates giant classes of vulnerabilities. You can write bad logic in any language. At least in Java you can't write bad logic that also suffers from memory issues.

Re:C++ creator rebuts White House warning by owlstuffing on Monday March 18, 2024 @07:40PM (#39751389)
> At least in Java you can't write bad logic that also suffers from memory issues.

Oh you bet you can. There are a number of ways to screw that up.

- memory leaks/loitering is quite common, gc won’t help if your code hangs on to stale refs

- using Unsafe memory can blow up in glorious C++ fashion, directly or indirectly

- using native calls incorrectly can be just as nasty

Re:C++ creator rebuts White House warning by ttfkam on Tuesday March 19, 2024 @12:27AM (#39752943)
I'd wager Unsafe in Java is far more rare per million lines of code written than unsafe blocks in Rust. Been coding in Java since ~1997. Unsafe just doesn't come up in 99.999% of Java projects.

Now JNI on the other hand, that made up maybe 0.5% back in the day. Not anymore where FFI is the predominant native linkage (but still comparatively quite rare).

(Cue the one weird guy coming out of the woodwork who claims that all of his Java projects in the last 10 years have used Unsafe to great effect.)

Re:C++ creator rebuts White House warning by owlstuffing on Tuesday March 19, 2024 @04:28PM (#39759909)
> Been coding in Java since ~1997. Unsafe just doesn't come up in 99.999% of Java projects.

Your project may not use it directly, but there’s a pretty good chance one of your libraries does.

Re:C++ creator rebuts White House warning by ttfkam on Wednesday March 20, 2024 @11:11AM (#39767735)
And when I code in C, there's typically at least one library with inline assembly even though my C doesn't use any inline assembly.

There is indeed a difference here between the vast majority taking part in risky behavior and library authors using focused performance improvements. There are a lot more eyes on the library code due to downstream effects than in everyday top-level code.