7 ms·

> Memory safety is much less of an issue than it used to be. This is demonstrably false: https://twitter.com/LazyFishBarrel/status/1129000965741404160 https://

> Memory safety is much less of an issue than it used to be. This is demonstrably false: https://twitter.com/LazyFishBarrel/status/1129000965741404160 https://twitter.com/LazyFishBarrel/status/112900096574140416... Additionally, new "safe" C++ APIs aren't: https://bugs.llvm.org/show_bug.cgi?id=34729 https://bugs.llvm.org/show_bug.cgi?id=34729 Apple's iOS 12.4 release fixes 37 CVEs, 28 of which are memory unsafety (75.7%). Microsoft's statistics corroborate this: https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se... Importantly, none of these sources show any improvements over time. If we saw meaningful improvements in "modern C++" codebases, I'd be much more willing to accept "modern C++". As it stands, there is no such evidence that "modern C++" provides any demonstrable benefits regarding memory safety.

kllrnohj 7y ago
> Additionally, new "safe" C++ APIs aren't: https://bugs.llvm.org/show_bug.cgi?id=34729 https://bugs.llvm.org/show_bug.cgi?id=34729 std::string_view is a borrow interface, not a safe owner. It is a sharp knife, to be sure, but it's not billed as being safe, either, and it's not broken.
jupp0r 7y ago
> Importantly, none of these sources show any improvements over time. If we saw meaningful improvements in "modern C++" codebases, I'd be much more willing to accept "modern C++". As it stands, there is no such evidence that "modern C++" provides any demonstrable benefits regarding memory safety. I don't know of any study comparing memory safety of "modern C++" vs "legacy C++" code. None of the references you provided contains any information about that, so I think it's unfair for you to pretend that it does. From my work over the last years I can tell you that the move from C++98 to C++11 and to a smaller extend the move from C++11 to C++14 has reduced memory corruption bugs by a significant amount. The way we teach C++ to junior engineers is very different to what it was before, a lot of practices that used to lead to unsafe conditions are frowned upon nowadays. It's by no means perfect compared to Rust, but it's definitely not the mess that it's often characterized at when people point to code that would never pass code review nowadays (ie the original article).
einpoklum 7y ago
The tweet you linked to does not demonstrate your claim; neither does the ZDNet article.
- moosingin3space 7y ago
  All of these sources show memory safety problems getting worse or staying equally prevalent, which directly contradicts the parent's claim that memory safety is "much less of an issue than it used to be".

kllrnohj 7y ago

> Additionally, new "safe" C++ APIs aren't: https://bugs.llvm.org/show_bug.cgi?id=34729 https://bugs.llvm.org/show_bug.cgi?id=34729 std::string_view is a borrow interface, not a safe owner. It is a sharp knife, to be sure, but it's not billed as being safe, either, and it's not broken.

jupp0r 7y ago

> Importantly, none of these sources show any improvements over time. If we saw meaningful improvements in "modern C++" codebases, I'd be much more willing to accept "modern C++". As it stands, there is no such evidence that "modern C++" provides any demonstrable benefits regarding memory safety. I don't know of any study comparing memory safety of "modern C++" vs "legacy C++" code. None of the references you provided contains any information about that, so I think it's unfair for you to pretend that it does. From my work over the last years I can tell you that the move from C++98 to C++11 and to a smaller extend the move from C++11 to C++14 has reduced memory corruption bugs by a significant amount. The way we teach C++ to junior engineers is very different to what it was before, a lot of practices that used to lead to unsafe conditions are frowned upon nowadays. It's by no means perfect compared to Rust, but it's definitely not the mess that it's often characterized at when people point to code that would never pass code review nowadays (ie the original article).

einpoklum 7y ago

The tweet you linked to does not demonstrate your claim; neither does the ZDNet article.

moosingin3space 7y ago
All of these sources show memory safety problems getting worse or staying equally prevalent, which directly contradicts the parent's claim that memory safety is "much less of an issue than it used to be".