this post was submitted on 26 Feb 2024
267 points (96.5% liked)
Programming
17509 readers
8 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities [email protected]
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I'm just glad to see the White House listening to people who understand technology for a change.
You don't have to ban C or C++; you just have to prove your programs are memory safe. It's been decades since I've coded in C, but surely Valgrind and ilk are now capable of providing reasonable proof of memory safety. You might have to turn up all the dials and set all-warnings-are-errors, but I'd be surprised if C tooling wasn't available to provide sufficient proof for a given statically-linked program.
Be prepared to be surprised then. If such tooling was available, why isn't it being used by the projects for whom it matters? Yes, there is tooling available, but all the big parties using them are admitting it's not good enough for them. Those tools help, but they do fail in the "sufficient proof" department.
For some follow-up reading:
They all share the same basic facts: C and C++ are inherently memory unsafe. If any of them could've "just prove[n] your programs are memory safe", I think they would have.
Oh, my dear, sweet, summer child. Welcome to capitalism, and the rule of "good enough." Static code analysis tools cost money, and take time to run. I've yet to work at a company that didn't have a documented process for entirely bypassing QA in urgent situations; although, when I contracted with the USFS, they were much more reluctant to cut corners - that was under a Democrat president; when Republicans took charge, they cut a lot of things, including software quality controls.
But - as I said - I haven't touched C in decades, so I can't refute your claim that such tools don't exist.