Hacker News Reader

Comment by zebra_cross21 | Hacker News Reader

Just use rust man :| why do you want to bring all your security vulnerabilities and undefined behaviors to web?

Why do people think the C++ of today is the same as the C++ of 1998? Today we have concepts such as RAII to clean up our objects when they go out of scope. We have references which are essentially safe pointers to an extent (see dangling references). References have always existed, but people insist on using raw pointers still. Finally, for those use cases where heap allocated memory is absolutely necessary, we have smart pointers which clean up the memory they own when the smart pointer object goes out of scope (an application of RAII). Other unsafe practices carried over from C such as void * type erasure are being replaced with type-safe objects (see std::any for C++17, boost::any for pre-C++17).

There's still plenty of ways to shoot yourself in the foot if you are "not careful" with the modern C++ code you write. See for example http://foonathan.net/blog/2017/03/22/string_view-temporary.h...

Modern C++ has a lot of great stuff to help, but the sense of safety you get when you use Rust is something else entirely.

Because Rust lets you hire noobs that don't know what they're doing and contains their damage. C++ is fine if you know what you're doing. It's ridiculous to claim that memory safety is helped by the use of references.

I can’t speak for everyone but I think of the C++ of today as being dangerously close to the C++ of 1998 because there is so much 1998 C++ code still being linked into most C++ projects. C++17 is incredibly powerful but it’s also hard to wield correctly and most people don’t have those skills yet (and almost none did while writing that 1998-originated library you eventually find yourself need to use). It’s not just the language that matters, it’s how that language gets used and by whom.

Might want to integrate an existing C++ code base into a server without developing an API or IPC in between the two. The security issues would be similar in either case and this would be much quicker to develop.

> Might want to integrate an existing C++ code base into a server without developing an API or IPC in between the two.

Or perhaps you might want to use a belt sander to refinish your table without removing the tablecloth from the table first. Not all the things one “might want to do” are good ideas, even if there’s a wikihow on best ways to do them.

C++ is a great language but it’s a very hard language to wield correctly. The odds there is an exploitable buffer overflow or injection attack buried deep in some part of the code are simply too high compared to memory managed languages with standard libraries designed from the ground up for web-facing applications.

this would be much quicker to develop.

There is almost literally no chance that this is the case. The amount of pointless boilerplate code that you'd have to write would be many, many, many times in excess of a thin API layer.

How do you suggest writing a thin API layer to expose an interactive real-time stream consumed over WebSocket?

Rust would be equally unsuitable to this task. Web development in C++ or Rust? Why?

There may be some advantages to writing a middle tier application server in either of these languages, but using a system language to manage a web front-end is effectively like using a hatchet to shave. Sure, the hatchet is faster at cutting wood than a safety razor, and if one is careful, it could be used to remove stubble, but chances are that one is not clearly thinking about the problem at hand to suggest such a tool.

As replied in another thread, IoT.

There aren't many options when you just have a few hundred KB.

Having a better and more expressive type system.

Reply on news.ycombinator.com