News for hackers. Stuff that matters.
Re:The empire of C++ strikes back with Safe C++ blueprint by blastonico on Sunday October 20, 2024 @08:30PM (#41899674)
There will always be security bugs. Why do you think otherwise?
Re:The empire of C++ strikes back with Safe C++ blueprint by pizlonator on Sunday October 20, 2024 @08:50PM (#41899748)
Yes but the point of safe languages is to eliminate the memory safety security bugs, which tend to be the worst and the most common.

An unsafe-by-default language that has some safety features isn't enough to fix memory safety.

Re:The empire of C++ strikes back with Safe C++ blueprint by uecker on Monday October 21, 2024 @01:11PM (#41906161)
I don't they are the worst (often hard or impossible to exploit) and also not the most common according to: https://www.cvedetails.com/vulnerabilities-by-types.php (despite likely easy to find).

Memory safety is something which can be solved though, which is what memory safe languages do. Of course, Rust is only an incremental improvement because of unsafe.

Re:The empire of C++ strikes back with Safe C++ blueprint by steveklabnik on Monday October 21, 2024 @01:15PM (#41906188)
The claim was scoped to the organizations that made the claim: Mozilla, Google, and Microsoft independently claimed that around 70% of their security issues were memory safety related, not that every CVE ever filed was that weighted towards one vulnerability class.
Re:The empire of C++ strikes back with Safe C++ blueprint by 29athrowaway on Sunday October 20, 2024 @08:54PM (#41899775)
There are bad ideas with known consequences. We know what happens if you aim at your foot with a shotgun and then fire, for example.

Unless you are doing something obscure like testing shotgun-proof footwear, it is a good idea to have an automated system tell you: "ERROR: You are shooting your foot, do not aim at your foot with a shotgun and fire on line 123".

The C and C++ philosophy starts with the premise "programmers know best and will never aim a shotgun at their foot and then fire, that makes no sense haha, why are you talking to me about that? you are silly!". Yet, there are millions of people getting shot in the foot every year and it took a new language to demonstrate that the entire class of nonsense can be prevented.

Re:The empire of C++ strikes back with Safe C++ blueprint by JohnFen on Sunday October 20, 2024 @09:23PM (#41899907)
> The C and C++ philosophy starts with the premise "programmers know best and will never aim a shotgun at their foot and then fire

That's absolutely not the C/C++ philosophy. The C philosophy (I lost track of whatever the C++ philosophy is supposed to be several versions back) is that it's a mid-level language and lets you have pretty low-level access to the machine. With that comes the need for great caution, much like working in assembly.

It's not premised on the idea that programmers are infallible at all, but on the idea that code-checking and correctness is to be done through process rather than the language itself.

Re:The empire of C++ strikes back with Safe C++ blueprint by vacuity on Sunday October 20, 2024 @10:21PM (#41900165)
It isn't what is explicitly touted as standard, but it is what many developers have culturally established.
Re:The empire of C++ strikes back with Safe C++ blueprint by eacnamn on Monday October 21, 2024 @01:11PM (#41906160)
>That's absolutely not the C/C++ philosophy

while it is not explicitly written out like this anymore, the standard charter used to say

> Trust the programmer.

> Don't prevent the programmer from doing what needs to be done.

for 30 something years, which sounds similar to what the other poster said.

The current charter[1] only says "Allow programming freedom" which I'd still interpret to mean something similar.

1: https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3280.htm

(edited due to formatting messups)

Re:The empire of C++ strikes back with Safe C++ blueprint by 29athrowaway on Tuesday October 22, 2024 @05:08PM (#41918715)
Some freedom is productive, some freedom is not.