Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

C++ creator rebuts White House warning

infoworld.com

Post reply on HN
Print view View original

121–130 of 141 posts

Re: C++ creator rebuts White House warning

#121

Post by jeffbee »

Scubabear68 wrote: post #118
CyberDildonics wrote: post #114

Earlier quoted context omitted.

followed by years of monotonic performance degradation as the flaws in the original are iteratively discovered and remediated. This doesn't make any sense and nothing in this comment is something an experienced optimizer would say. I'm not sure where the fantasy comes from that java is going to beat C++, but anyone experienced in optimization is going to control their memory allocations, then control data access bein…

C++ does indeed give you this level of control. Most C++ code I have seen does not even approach this level of care and customization. When we are talking about speed, most people mean basic out-of-the-box speed of the code without heroic efforts. C++ and Java are a wash at this point performance wise. Most analytics code I have seen on Wall Street was either Java or C++, with the choice driven by what the quants wan…

Even the heroes eventually capitulate to complexity in C++, compromising performance. It is virtually impossible to write a realistically complex zero-copy RPC server in C++ because the lifetime issues are too daunting. You don't get it "for free" in Java but because the language and the JVM have formalized the lifetime problem you can write a zero-copy RPC service very, very cheaply. Even Go can beat C++ in this use case, for the same reasons.

All the other stuff in this thread amounts to toy problems, from a software engineering complexity standpoint. Yes, you can write a fairly good CFD kernel in C, C++, or fortran. There are no lifetime or boundary issues in these use cases. The safety of the language in such cases is of no interest.

Re: C++ creator rebuts White House warning

#122

Post by kazinator »

amluto wrote: post #117
kazinator wrote: post #65

Earlier quoted context omitted.

C++ is safe if you ignore most of its libraries and write everything from scratch, making safety your #1 priority, ahead of performance and everything else, and then doggedly stick to using nothing but the safe primitives you have created.

I guess you had better never use a class template, then, because that typename T parameter and associated member of type T is polymorphic over whether it is a reference or pointer to a value owned elsewhere.

How you instantiate a template is under your control (except when it's a decision in a legacy codebase you've inherited).

Re: C++ creator rebuts White House warning

#123

Post by kazinator »

kstrauser wrote: post #7

There's the language as idealized, and the language as used. Stroustrup is clearly brilliant, but he's talking about the former while everyone else means the latter. If you started a brand new C++ project today, using only the modern, safe ways of doing things and including only dependencies that do the same, OK, fine. That's, what, 0.1% of C++ projects? The rest of them use a soup of features and misfeatures that've…

> Stroustrup is clearly brilliant, but he's talking about the former while everyone else means the latter.

Where is he doing this? His main statement doesn't bear out this accusation: "“[t]here are two problems related to safety. Of the billions of lines of C++, few completely follow modern guidelines, and peoples’ notions of which aspects of safety are important differ. I and the C++ standard committee are trying to deal with that.”

Re: C++ creator rebuts White House warning

#124

Post by kazinator »

Calavar wrote: post #48
kstrauser wrote: post #7

There's the language as idealized, and the language as used. Stroustrup is clearly brilliant, but he's talking about the former while everyone else means the latter. If you started a brand new C++ project today, using only the modern, safe ways of doing things and including only dependencies that do the same, OK, fine. That's, what, 0.1% of C++ projects? The rest of them use a soup of features and misfeatures that've…

I'd say it's actually the other way around. C++ in the abstract is full of half-baked, ill conceived ideas that later had to be deprecated or walked back entirely: std::auto_ptr and memory leaks; std::shared_ptr::unique() not being threadsafe; taking the time to implement bounds checking in std::vector, but the default access operator isn't checked; corner cases with std::initializer_list leading to unexpected behavi…

C++ could benefit from a grassroots project to provide a from-the-ground up alternative library, which shares not a single thing with the ISO C++ one. It would provide everything: I/O streams, strings, containers, smart pointers, ...

This project's number one priority would be safety, followed by ergonomics. Performance would be somewhere down the list, below portability.

Re: C++ creator rebuts White House warning

#125

Post by cbsmith »

marcus0x62 wrote: post #107
cbsmith wrote: post #82

Earlier quoted context omitted.

> It’s been holding up pretty well for the specific memory safety guarantees offered by modern languages That seems unrelated to whether people need to be perfect to avoid security exposures. In fact, it would seem to be in contradiction. > if your language is unsafe and has a bunch of foot guns in it, all the users of that language have to be perfect all the time to avoid trouble That's an entirely different argumen…

> That seems unrelated to whether people need to be perfect to avoid security exposures. In fact, it would seem to be in contradiction. It seems to me to be directly related when modern languages make certain types of mistake impossible, imperfect though the creators of those languages are. > That's an entirely different argument, and depends on the semantics of "unsafe" and "foot guns". No. It is literally the same…

Some modern languages have protections from some types of mistakes. C++ has some protections for some types of mistakes as well. I agree that there is decades of evidence that people can create security vulnerabilities in C++. I could quibble that C++20 is not the same language that most of those vulnerabilities occurred with, and that if we called Rust "C++24" it'd be no more prone to security vulnerabilities, but that seems like a mostly silly argument.

However, I would point out that some very non-modern languages also offer protection from the same class of memory-safety mistakes, but over decades have proven to be fully capable of having serious security vulnerabilities.

It is also true that we have decades of evidence that C++ programmers aren't perfect, often make mistakes, and often make mistakes that don't lead to security vulnerabilities, both due to protections in the toolset, and because lack of perfection doesn't mean you've got a security vulnerability.

It'd be great to eliminate a whole class of vulnerabilities by always using tools that prevent them, but you have to consider the price that comes with it. In particular, switching everything over to a new set of tools involves rewriting all that code, and that creates the possibility that entirely different classes of security vulnerabilities (some that C++ might offer protections & mitigations for) could be introduced in to programs that have proven to be secure, sometimes for decades.

It's a far more nuanced problem. Rather than taking an absolutist position, I think it makes sense to do what we've always done (or at least should always do), which is on a case-by-case basis, weigh the risks and make the appropriate choices. I'm sure that will lead to C++ not being used in a lot of cases.

Re: C++ creator rebuts White House warning

#126

Post by CyberDildonics »

jeffbee wrote: post #121
Scubabear68 wrote: post #118

Earlier quoted context omitted.

C++ does indeed give you this level of control. Most C++ code I have seen does not even approach this level of care and customization. When we are talking about speed, most people mean basic out-of-the-box speed of the code without heroic efforts. C++ and Java are a wash at this point performance wise. Most analytics code I have seen on Wall Street was either Java or C++, with the choice driven by what the quants wan…

Even the heroes eventually capitulate to complexity in C++, compromising performance. It is virtually impossible to write a realistically complex zero-copy RPC server in C++ because the lifetime issues are too daunting. You don't get it "for free" in Java but because the language and the JVM have formalized the lifetime problem you can write a zero-copy RPC service very, very cheaply. Even Go can beat C++ in this use…

Even the heroes eventually capitulate to complexity in C++, compromising performance.

It is usually dead simple. Reserve memory in a vector, put data in, loop through it linearly. Modern C++ is very simple most of the time. Where are you getting this idea?

It is virtually impossible to write a realistically complex zero-copy RPC server in C++ because the lifetime issues are too daunting.

This is not only untrue, it doesn't even make sense. What is it that you think can be done in java and what are these lifetime issues you think are in the way? You didn't give any actual technical examples, so feel free to show something real and back up this claim.

Even Go can beat C++ in this use case, for the same reasons

Prove it, let's see where these ideas are coming from, because I don't think they are coming from experience with C++.

The safety of the language in such cases is of no interest.

This is also overblown in modern C++. It is easy to boil things down to value semantics and let simple lifetimes manage resources with scope. When it isn't something you can do with scope and you have to manage resources yourself, the language won't help you anyway since you are writing it yourself.

Re: C++ creator rebuts White House warning

#127

Post by spacechild1 »

User3456335 wrote: post #70
klodolph wrote: post #23

Earlier quoted context omitted.

> The first step to solving a problem is accepting reality. Ok, the first thing I’d like to accept is that C++ is just not safe enough for most applications. And yes—you also can’t throw C++ in the garbage. Both of those statement are part of our reality—C++ is unsafe, and we will use it anyway. That’s why we solve this problem on two fronts. First, we advise programmers to ditch C++ for safer languages, when reasona…

I've yet to see a valid scenario where C++ is superior to Rust, Python and Go. Use Python. If you need concurrency, then use Go. If you need even more performance, use Rust (using unsafe Rust only for the parts that need it). For the highest performance stuff, maybe consider C for critical parts only. C++ is not safe. It's a minefield of things that compile but are memory management mistakes. And then you're like "Lo…

> I've yet to see a valid scenario where C++ is superior to Rust, Python and Go.

What? Python and Go are used in entirely different domains. Not everything is a web backend!

Today C++ is used mainly for performance critical applications: HPC, realtime audio, video editors, game engines, web browsers, operating systems, etc. In these fields, Rust would be pretty much the only practical alternative, but it still needs to catch up with the massive and mature(!) C++ ecosystem. Things like Eigen cannot even be implemented efficiently in Rust because its metaprogramming features are still too limited.

Re: C++ creator rebuts White House warning

#128

Post by shrimp_emoji »

pkulak wrote: post #25
7e wrote: post #13

Earlier quoted context omitted.

Programmer education, tools, language standards and best practices are all vastly different than 50 years ago. That's like pointing at a Ford Edsel and then claiming that modern humans can't make good cars.

In 1958 35,000 people died on American roads. Last year, 43,000. So yeah, cars have gotten safer at about the rate that C++ has.

Hehe, but if you count "broken dependencies" as accidents/fatalities akin to bugs, it's way safer than all new languages by virtue of being too old/disorganized for a built-in packaging system.

The left-pad incident was a 4,000,000-car pile up!

Re: C++ creator rebuts White House warning

#129

Post by shrimp_emoji »

AlotOfReading wrote: post #54

Stroustrup needs to realize that "just wait a few more years" isn't an acceptable answer when you're already a decade late to the party. The white house is not some radical pioneer at the frontier of programming language design. By the time it says anything on the subject, it's been obvious to everyone else for years. There might be a reasonable discussion here if we were discussing profiles when the earliest incarna…

Bjarne is simply pointing out that if we wait for static analysis tools to become sentient thanks to upcoming breakthroughs in AI and quantum computing, we can finally have fewer CVEs in C++ software.

> The white house is not some radical pioneer at the frontier of programming language design. By the time it says anything on the subject, it's been obvious to everyone else for years.

That we should return to Ada? ;p Oh, wait, sorry; I have no idea what that is. We need Rust.

Re: C++ creator rebuts White House warning

#130

Post by jeffbee »

CyberDildonics wrote: post #126
jeffbee wrote: post #121

Earlier quoted context omitted.

Even the heroes eventually capitulate to complexity in C++, compromising performance. It is virtually impossible to write a realistically complex zero-copy RPC server in C++ because the lifetime issues are too daunting. You don't get it "for free" in Java but because the language and the JVM have formalized the lifetime problem you can write a zero-copy RPC service very, very cheaply. Even Go can beat C++ in this use…

Even the heroes eventually capitulate to complexity in C++, compromising performance. It is usually dead simple. Reserve memory in a vector, put data in, loop through it linearly. Modern C++ is very simple most of the time. Where are you getting this idea? It is virtually impossible to write a realistically complex zero-copy RPC server in C++ because the lifetime issues are too daunting. This is not only untrue, it d…

> Reserve memory in a vector, put data in

You've already proven that you don't know what I am talking about and now you are doubling down. There is no way to put data into a std::vector without copying it. Vector can't adopt memory that already exists. So your plan doesn't suit the use case I am discussing: zero-copy RPC servers.

Post reply on HN