Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

C++ creator rebuts White House warning

infoworld.com

Post reply on HN
Print view View original

21–30 of 141 posts

Re: C++ creator rebuts White House warning

#21

Post by moomin »

cqqxo4zV46cp wrote: post #14
kstrauser wrote: post #7

There's the language as idealized, and the language as used. Stroustrup is clearly brilliant, but he's talking about the former while everyone else means the latter. If you started a brand new C++ project today, using only the modern, safe ways of doing things and including only dependencies that do the same, OK, fine. That's, what, 0.1% of C++ projects? The rest of them use a soup of features and misfeatures that've…

> If it turned out that every remaining C++ shop is great at writing C++ code, because all the shops that weren't gave up and migrated to something else, I wouldn't be shocked. I would. Almost all conversations about C/C++ security are, to this day, alive with people that are in my opinion delusional. The survivorship bias is more that the community is left with an over-representation of people that take “it’s often…

Boy do I have some codebases I could show you. I mean, the biggest problem isn’t that they’re written in C++, but it really didn’t help either.

Re: C++ creator rebuts White House warning

#22

Post by cedws »

He seems to be in denial. I watched Stroustrup's CppCon 2023 talk about safety[0] a few months back. He spends about an hour talking about how important safety is and all the new things C++ offers to write safe code. Why did he suddenly start caring about safety now?

C++ is like a mad hatter's bad acid trip and somehow people are convinced it's still a great language to use in 2024.

[0]: https://www.youtube.com/watch?v=I8UvQKvOSSw

Re: C++ creator rebuts White House warning

#23

Post by klodolph »

jvanderbot wrote: post #12

The amount of iconoclastic knee jerking in this thread is kinda nuts. Equating this rebuttal to an old man yelling at clouds? Saying Cpp never made sense? The first step to solving a problem is accepting reality. Cpp has been foundational, like C, to our computing world. If the rich legacy of libraries that underpin our "better" language choices is offensive to us, or if we really believe we are powerless to improve…

> The first step to solving a problem is accepting reality.

Ok, the first thing I’d like to accept is that C++ is just not safe enough for most applications. And yes—you also can’t throw C++ in the garbage.

Both of those statement are part of our reality—C++ is unsafe, and we will use it anyway. That’s why we solve this problem on two fronts. First, we advise programmers to ditch C++ for safer languages, when reasonable, because C++ isn’t safe enough for most needs. Second, we invest a lot of energy into making C++ safer, with better tools, safer libraries, changes to compilers, static analysis, run-time instrumentation, etc. It won’t close the gap—C++ is still unsafe and will be for the foreseeable future—but it will make a big difference to the people who, for whatever reasons, still use C++ despite its safety problems.

The C++ FAQ has a better picture here:

https://isocpp.org/wiki/faq/big-picture

> In 99% of the cases, programming language selection is dominated by business considerations, not by technical considerations. Things that really end up mattering are things like availability of a programming environment for the development machine, availability of runtime environment(s) for the deployment machine(s), licensing/legal issues of the runtime and/or development environments, availability of trained developers, availability of consulting services, and corporate culture/politics. These business considerations generally play a much greater role than compile time performance, runtime performance, static vs. dynamic typing, static vs. dynamic binding, etc.

There are a lot of good reasons to use C++. C++ is also unsafe. Both are true.

We don’t need to write long apologia explaining why C++ is actually safe, and you shouldn’t be looking at legacy code, or you need to hire better programmers, or you’re using the wrong tools or wrong practices or something like that. Ultimately, those arguments don’t withstand scrutiny.

Re: C++ creator rebuts White House warning

#25

Post by pkulak »

7e wrote: post #13
marcus0x62 wrote: post #10

> Of the billions of lines of C++, few completely follow modern guidelines, and peoples’ notions of which aspects of safety are important differ. I and the C++ standard committee are trying to deal with that If only people were perfect, then things would be perfect. There’s, what, 40 years of evidence to suggest that most people, most of the time, simply cannot write memory-safe C++ code (50 years if you count C.) Ma…

Programmer education, tools, language standards and best practices are all vastly different than 50 years ago. That's like pointing at a Ford Edsel and then claiming that modern humans can't make good cars.

In 1958 35,000 people died on American roads. Last year, 43,000. So yeah, cars have gotten safer at about the rate that C++ has.

Re: C++ creator rebuts White House warning

#26

Post by moomin »

marcus0x62 wrote: post #19
7e wrote: post #13

Earlier quoted context omitted.

Programmer education, tools, language standards and best practices are all vastly different than 50 years ago. That's like pointing at a Ford Edsel and then claiming that modern humans can't make good cars.

I’m not pointing at a contemporary akin to Ford or Edsel. I’m pointing at people today using the latest versions of these tools today making the same class of mistake as someone might have made 4 or 5 decades ago. The tool is the problem.

Ironically, Margaret Hamilton _was_ able to produce a bug free program back in the 60s. However, no-one is seriously considering replicating her techniques because they (some of them, ant least) are way too expensive for modern software.

Re: C++ creator rebuts White House warning

#27

Post by cbsmith »

marcus0x62 wrote: post #10

> Of the billions of lines of C++, few completely follow modern guidelines, and peoples’ notions of which aspects of safety are important differ. I and the C++ standard committee are trying to deal with that If only people were perfect, then things would be perfect. There’s, what, 40 years of evidence to suggest that most people, most of the time, simply cannot write memory-safe C++ code (50 years if you count C.) Ma…

> If only people were perfect, then things would be perfect.

That argument doesn't hold up too well, considering that people are involved either way.

Re: C++ creator rebuts White House warning

#28

Post by Cloudef »

Even such basics as initialization is full of traps in C++, its truly language thats awful to produce anything safe with. C on the other hand isnt a bad language, but C's problem comes from the horrible standard library and bad standard. You can create much better C by passing -fno-strict-aliasing -ftrapv -fsigned-char to the compiler even now. Heck rust's unsafe is more unsafe than C. "C" could be improved with a better compiler that ignores the standard, but perhaps it wouldnt be C anymore even if the syntax remained the same.

C++ problem is not helped by the compilers either, shoutouts to msvc++ accepting absolutely wrong and horrible code by default.

Re: C++ creator rebuts White House warning

#29

Post by pizlonator »

C++ is an unsafe language in all of its current implementations except CHERI.

Stroustrup is being tone deaf or maybe he just doesn’t get it.

The issue is that there are so many ways in which you could write a C++ expression that violates memory safety and gives users control of your heap.

In Java or other truly safe languages, there are zero ways to do that short of pwning the JVM with a bug. In Rust and other safe systems languages, to do something unsafe you have to call it out using the unsafe keyword.

So - the places in your C++ code where you might have a memory safety violation are everywhere while in the alternatives they are either nowhere or they are carefully demarcated.

Re: C++ creator rebuts White House warning

#30

Post by owlstuffing »

kstrauser wrote: post #11
throw7 wrote: post #8

Yeah. The language you pick doesn't magically make you Fort Knox regardless of "memory safety". Rewind in time and the White House would be berating all of us to write in Java... you know... a "memory safe" language, only for the worst security fail to come along Log4Shell.

I don't like Java. Nothing about it appeals to me. It pains my eyes to look at it. And in spite of my distaste for it, I respect that it completely eliminates giant classes of vulnerabilities. You can write bad logic in any language. At least in Java you can't write bad logic that also suffers from memory issues.

> At least in Java you can't write bad logic that also suffers from memory issues.

Oh you bet you can. There are a number of ways to screw that up.

- memory leaks/loitering is quite common, gc won’t help if your code hangs on to stale refs

- using Unsafe memory can blow up in glorious C++ fashion, directly or indirectly

- using native calls incorrectly can be just as nasty

Post reply on HN