Secure software can be written in C or C++ (they are two different languages BTW). For example, OpenBSD and OpenSSH. Both are written in C and both have very good security records.
Let’s sunset C/C++
11–20 of 137 posts
Re: Let’s sunset C/C++
#12So what language to you propose we use to rewrite all video and audio software? Javascript, Lua, Brainfuck, what? Sure make every numeric value a double, nobody ever wants a char. Don't allow contiguous blocks of memory. Or if you do check every access is within the bounds. Its all safe! Nobody cares that suddenly we can't decode an MP3 in realtime.
Are you going to outlaw assembly too?
What utter insanity.
Re: Let’s sunset C/C++
#13This is quite ignorant of why C/C++ is used. It is used for that exact memory control and access that this article demonizes so that we can have efficient and thought out systems. When those systems aren't well thought out or secure you have security issues. C/C++ lets you build a wobbly treehouse _and_ a secure fortress. It is up to the developer which one is made...
> This is quite ignorant of why C/C++ is used.
C and C++ are used due to UNIX becoming widespread, opening the door to those languages in the industry, and killing safer systems programming languages in the process.
The majority of security exploits in C and C++ aren't possible in Modula-2, Ada, Algol, just to cite a few examples.
To quote Hoare on his award's speech, The Emperor's Old Clothes:
"Many years later we asked our customers whether they wished us to provide an option to switch off these checks in the interests of efficiency on production runs. Unanimously, they urged us not to - they already knew how frequently subscript errors occur on production runs where failure to detect them could be disastrous. I note with fear and horror that even in 1980, language designers and users have not learned this lesson. In any respectable branch of engineering, failure to observe such elementary precautions would have long been against the law"
Re: Let’s sunset C/C++
#14So what language to you propose we use to rewrite all video and audio software? Javascript, Lua, Brainfuck, what? Sure make every numeric value a double, nobody ever wants a char. Don't allow contiguous blocks of memory. Or if you do check every access is within the bounds. Its all safe! Nobody cares that suddenly we can't decode an MP3 in realtime. Are you going to outlaw assembly too? What utter insanity.
Ada, Modula-2, ....
> What utter insanity.
Insanity is that C and C++ keep being used.
Re: Let’s sunset C/C++
#15This is quite ignorant of why C/C++ is used. It is used for that exact memory control and access that this article demonizes so that we can have efficient and thought out systems. When those systems aren't well thought out or secure you have security issues. C/C++ lets you build a wobbly treehouse _and_ a secure fortress. It is up to the developer which one is made...
A place where your reasoning breaks down is when one comes to define "the developer". There are a few legendary developers in the world I would trust to write secure C/C++. Others may be able to do so, by luck. Would I trust an organization of 2000 people all developing the same large code base? I know there are processes that can be adopted, such as using clever static analysis tools and rigorous review by security…
This will happen regardless of C or C++.
Re: Let’s sunset C/C++
#16Secure software can be written in C or C++ (they are two different languages BTW). For example, OpenBSD and OpenSSH. Both are written in C and both have very good security records.
You are joking in regards to OpenSSH right?
Re: Let’s sunset C/C++
#17So what language to you propose we use to rewrite all video and audio software? Javascript, Lua, Brainfuck, what? Sure make every numeric value a double, nobody ever wants a char. Don't allow contiguous blocks of memory. Or if you do check every access is within the bounds. Its all safe! Nobody cares that suddenly we can't decode an MP3 in realtime. Are you going to outlaw assembly too? What utter insanity.
Pffft... Javascript. Don't you read CodingHorror? W/E!
/s
Re: Let’s sunset C/C++
#18C still got a right to exist even in the very sensitive mission-critical environments, as long as MISRA requirements are followed (and, the good thing is that they can be automatically enforced).
MISRA makes C look like Ada with C syntax.
Re: Let’s sunset C/C++
#19This is quite ignorant of why C/C++ is used. It is used for that exact memory control and access that this article demonizes so that we can have efficient and thought out systems. When those systems aren't well thought out or secure you have security issues. C/C++ lets you build a wobbly treehouse _and_ a secure fortress. It is up to the developer which one is made...
A place where your reasoning breaks down is when one comes to define "the developer". There are a few legendary developers in the world I would trust to write secure C/C++. Others may be able to do so, by luck. Would I trust an organization of 2000 people all developing the same large code base? I know there are processes that can be adopted, such as using clever static analysis tools and rigorous review by security…
"...But time and time again, the community says "Yay, we've invented X, this makes a huge class of security bugs obsolete". Then Y comes along and opens the playing field again..."
To be fair...
This issue exists with every other language as well. I would be very skeptical of any language claiming to be 100% secure.
The same is true of the developer argument. Cyclone, Rust, C#, Java... you name it... they are all capable of producing systems with security vulnerabilities owing to developer quality inconsistencies.
Re: Let’s sunset C/C++
#20Absurdly absurd ideas and ramblings. I suppose we can write our "safe languages" in "safe languages" then we'll never have need of really programming anything ourselves. We can simply pat together what ever is "safe" for us to do in our little play sandbox and act like we're adults who understand the problems faced when programming in "real" languages. This would be similar to replacing all automobiles with stuffed a…
Rule 20.4 (required): Dynamic heap memory allocation shall not be used. Good luck writing misra-compliant web browser. And yes, safe languages can be written in safe languages. See rust and servo.
Rust and servo are great projects, but I would say there's still some time before Rust can completely replace C/C++. The language is stable, but there's still a lot of tooling that needs to be built up, and the compiler needs to be more performant. I also think it needs a few more small features in order to truly compete with C++ (it's already on par with C, in my opinion), e.g. being able to specify sized traits as return types. Once that's all done I think starting new projects in C/C++ wouldn't make sense anymore.