Re:The search for easier safe systems programming
by bluGill on Wednesday May 08, 2024 @10:53AM
(#40298754)
People keep saying this, yet undefined behavior sanitizer proves in the real world it isn't an issue most of the time.
Most real world security issues have nothing to do with code. Social engineering breaks more security than memory issues. We are also skewed by many of the fundamental programs are written in C and so there is a lot of value in finding holes.
Re:The search for easier safe systems programming
by pjc50 on Wednesday May 08, 2024 @11:13AM
(#40299022)
The US government official cybersecurity people have a different opinion. https://www.whitehouse.gov/oncd/briefing-room/2024/02/26/pre...
"Undefined behavior" is not reality; it's a strange shadow world where anything may happen. The compiler reserves the right to reject your reality and substitute its own - which it will not show you within the language, nor let you choose or hint, nor warn you.
People like to use C and C++ as if they were a species of typesafe macro assembler that always produces predictable machine code, and that breaks down often enough that the world is full of systems-level CVEs.