Depending on how you look at it, that raises the question of "if this is so effective, and it's already available, why hasn't the situation improved?"
Which I think it was much better back when it was C++ vs C in the C++ARM days, with great compiler provided frameworks, eventually past C++98 there seems to have been an inversion, as C++ graduality took over domains where C ruled.
The same mideset that will reach out for unsafe language constructs, regardless of the programming language, without any kind of profiler information, because of course it is faster and every μs counts.
1. who says it hasn't?
2. most of the vul code is C, which is obviously much harder to harden, and the Rust Evangelism Strike Force loves to pretend that C++ is the same as C, so no matter the improvements to C++, they will just point at C.
3. I think many simply didn't know about these hardening modes, MSVC has had this for 10-15 years, but I still encounter people who don't know about it..somehow.As long as that C code is valid C++ code, it’s still a problem for C++. Backwards compatibility with C is a strength, but also a weakness. The Go and Java folks invested in rewriting dependencies in their own language to prevent problems, if C++ is truly that much safer than C, the C++ community could do the same, and demonstrate that it’s safer.
This is the power of opt out vs opt in. You can’t forget to run the borrow checker in Rust. That’s a practical, real-world advantage.