Re:The CERT C Secure Coding Standard
by jeffreyrogers on Wednesday January 21, 2015 @08:14AM
(#8922896)
Some people like programming in C.
[ Parent
| on HN ]
Re:The CERT C Secure Coding Standard
by Someone1234 on Wednesday January 21, 2015 @10:03AM
(#8923330)
Some people like smoking meth. That's a rather incomplete argument for why it is a good idea.
C/C++ is likely fine for e.g. games programming where speed is of maximum importance and security/verifiability is not.
However in 2015 I would not write nor recommend others write new system services (e.g. DNS, DHCP, web servers, etc) in C or even C++. They're insecure by design and as history has shown us, they cannot be made secure.
That all being said, as there is a massive code base of pre-existing code it is often impractical to not continue these projects in C/C++. It would require tens of years of work to do so. However if an OpenSSL replacement was written in a more secure language with verification being a priority from the ground up, I'd be all over that like a cat on tuna.