"The development of new product lines for use in service of critical infrastructure or [national critical functions] NCFs in a memory-unsafe language (e.g., C or C++) where there are readily available alternative memory-safe languages that could be used is dangerous and significantly elevates risk to national security, national economic security, and national public health and safety," the report says.
"Putting all new code aside, fortunately, neither this document nor the U.S. government is calling for an immediate migration from C/C++ to Rust — as but one example," he said. "CISA's Secure by Design document recognizes that software maintainers simply cannot migrate their code bases en masse like that."
But for all new code, bros it's ogre.
"For existing products that are written in memory-unsafe languages, not having a published memory safety roadmap by Jan. 1, 2026, is dangerous and significantly elevates risk to national security, national economic security, and national public health and safety," the report said.
It's ogre.
Jump in the discussion.
No email address required.
I haven't payed attention to this stuff in years, but is there no other choice except Rust?
Jump in the discussion.
No email address required.
Java, C#.
But it's kinda funny that those runtimes are implemented in C++ still. Idk about rust's.
Jump in the discussion.
No email address required.
Rust's is self hosted, runtime and compiler.
Jump in the discussion.
No email address required.
Isn't it still using LLVM as the main backend?
Jump in the discussion.
No email address required.
More options
Context
rust is compiled assembly instructions. It has the same runtime as C in all systems people give a shit about
Jump in the discussion.
No email address required.
More options
Context
More options
Context
So I'm not completely obsolete yet.
Jump in the discussion.
No email address required.
tbh I would happily write shit in modern C# till the end of times. Here's a very funny C++ bug from a couple of years ago, can you figure out what is happening? (heavily paraphrased and shortened ofc)
After upgrading to the next release (both the libraries implementing the internal stuff like the Collection type, and the compiler version) this code started crashing at
stuff.get("flag")
saying that the flag is not in fact there.Jump in the discussion.
No email address required.
I've never done C++ before (except when my dad was "helping" me as a little kid) so be patient with me... Is it something related to the "==" operator?
Jump in the discussion.
No email address required.
No. It's the most diabolical programming language feature called "undefined behavior". I can't overstate how much worse it is than it sounds. Since there's no return statement on the path where stuff.contains("flag") evaluates to false the compiler simply removes the check.
Jump in the discussion.
No email address required.
This is a huge problem for people still coding in notepad with warnings off
Jump in the discussion.
No email address required.
Jump in the discussion.
No email address required.
More options
Context
IDE users look like an adult cycling with training wheels
Jump in the discussion.
No email address required.
Maybe, but you look even dumber if you write buggy code that would have immediately been caught by one.
It's like riding withing training wheels and continuously crashing into every pole
Jump in the discussion.
No email address required.
More options
Context
More options
Context
It was a template function and that warning is disabled for those. Because people apparently rely on it when summoning nasal demons.
Jump in the discussion.
No email address required.
More options
Context
Jump in the discussion.
No email address required.
More options
Context
Democracy is the art and science of running the circus from the monkey cage.
Jump in the discussion.
No email address required.
More options
Context
More options
Context
that's the r-slurred c++ behaviour i expect
Jump in the discussion.
No email address required.
C++ should have been taken out back and shot as an act of mercy about 15 years ago.
Jump in the discussion.
No email address required.
More options
Context
More options
Context
So even though you can't possibly get to the end of this without running into a return statement, it wants one at the end too?
Jump in the discussion.
No email address required.
You can get to the end, that's the point. You'd thing that "undefined behavior" would mean that the function returns garbage, not that the compiler mercilessly eliminates all code on the paths that might lead to it.
Jump in the discussion.
No email address required.
fascinating btw. I'm assuming then that whatever is left in the output register stays in the output register? So, depending on os/compiler differences the likely outcome is a null pointer if the register is 0'd out, or returning some other bogus data that's interpreted as a std::string, or potentially overwriting some previous functions return value?
Jump in the discussion.
No email address required.
More options
Context
More options
Context
More options
Context
I don't code in C++ but are you sure it's UB and not a panic/exception? Panicking at table lookup when the key doesn't exist is not UB and it's done in others language too (rust).
That's so r-slurred, but it's c++ so I'm not really surprised
Jump in the discussion.
No email address required.
It's the absence of the return statement if the key is not in the table. That's specifically UB and causes an equivalent of
__builtin_unreachable()
being inserted. That was a bug I actually caught in the wild after we switched to GCC8 at work.Another fun example that I've seen people do is trying to check for integer overflow,
if (increment > 0 && x + increment > x)
doesn't work.Jump in the discussion.
No email address required.
More options
Context
More options
Context
More options
Context
More options
Context
More options
Context
More options
Context
More options
Context
Zig is getting a lot of hype, but I can't tell if it's actually good.
Jump in the discussion.
No email address required.
I've been eyeing Zig for a while now to try and shift away from C++. Mainly because I see no point using a language which industry veterans hate to use. They'll tell you, "Don't use classes or the standard library. The tooling is garbage, along with modern C++. At the end of the day, you're better off with C."
Zig supports arenas out of the box, has a lower memory footprint than C++, and interops with C without making you jump through hoops. Its assembly output is near identical to C. From what I understand, there are no hidden allocations, ever. I'd say Andy Kelley really wants to take lessons from the last 50 years of C and make a memory unsafe language that doesn't suck.
You might be saying, why not use Rust? And I think Zig's answer would be, the issue isn't really about memory safety, that's missing the point. The point is up until now, reliable memory management techniques like pointer handles, asan poisoning, and arenas were always DIY and they don't have to be. Writing code in memory unsafe languages shouldn't feel this archaic.
Jump in the discussion.
No email address required.
More options
Context
zig is very nice but not really mem safe. better than c though, it has nullable types
Jump in the discussion.
No email address required.
More options
Context
More options
Context
Virtually any language with a Garbage collector's a valid choice, Rust's just the meme because it's meant to occupy the same niche C/C++ do in 2024, which is to have manual memory allocation and utmost speed.
Jump in the discussion.
No email address required.
More options
Context
More options
Context