Hacker News Reader

Hacker News

Comment by moosingin3space | Hacker News Reader

Parent Full thread

moosingin3space

> Memory safety is much less of an issue than it used to be.

This is demonstrably false: https://twitter.com/LazyFishBarrel/status/112900096574140416...

Additionally, new "safe" C++ APIs aren't: https://bugs.llvm.org/show_bug.cgi?id=34729

Apple's iOS 12.4 release fixes 37 CVEs, 28 of which are memory unsafety (75.7%).

Microsoft's statistics corroborate this: https://www.zdnet.com/article/microsoft-70-percent-of-all-se...

Importantly, none of these sources show any improvements over time. If we saw meaningful improvements in "modern C++" codebases, I'd be much more willing to accept "modern C++". As it stands, there is no such evidence that "modern C++" provides any demonstrable benefits regarding memory safety.

View on HN

> Importantly, none of these sources show any improvements over time. If we saw meaningful improvements in "modern C++" codebases, I'd be much more willing to accept "modern C++". As it stands, there is no such evidence that "modern C++" provides any demonstrable benefits regarding memory safety.

I don't know of any study comparing memory safety of "modern C++" vs "legacy C++" code. None of the references you provided contains any information about that, so I think it's unfair for you to pretend that it does. From my work over the last years I can tell you that the move from C++98 to C++11 and to a smaller extend the move from C++11 to C++14 has reduced memory corruption bugs by a significant amount. The way we teach C++ to junior engineers is very different to what it was before, a lot of practices that used to lead to unsafe conditions are frowned upon nowadays. It's by no means perfect compared to Rust, but it's definitely not the mess that it's often characterized at when people point to code that would never pass code review nowadays (ie the original article).

> Additionally, new "safe" C++ APIs aren't: https://bugs.llvm.org/show_bug.cgi?id=34729

std::string_view is a borrow interface, not a safe owner. It is a sharp knife, to be sure, but it's not billed as being safe, either, and it's not broken.

The tweet you linked to does not demonstrate your claim; neither does the ZDNet article.

All of these sources show memory safety problems getting worse or staying equally prevalent, which directly contradicts the parent's claim that memory safety is "much less of an issue than it used to be".

Reply on news.ycombinator.com