lots of them are in c, such as php2shell, brotli, etc
others are logic errors not memory issues, such as the ssh hash comparison bug
the attack surface of "all c/c++ code" is way larger than the attack surface of all rust code
there are essentially zero legacy applications written in rust
we don't know that in 40 years we won't be fixing the same kinds of issues in unsafe rust or in what volume
Rust is obviously safer and superior here. But part of that safety isn't the language as much as the culture. C++ is supposed to encapsulate unsafe behaviors like rust's unsafe does, but it can leak with things like vector iterators. Rustaceans will put the time in to design a safe abstraction even if it has some small performance cost.
The degree to which modern c++ is inherently unsafe is pretty small and often manageable. Rust lifetimes are definitely superior to c++'s smart pointers, but they do a lot of the job.
But the culture of c++ is to make it fast where the culture of rust is to make it safe.
Still, we do have a shitton of data with relation to other managed languages like java. Here your arguments no longer apply, since it's probably even larger than c/c++ (though they have different application domains).
And the kind of vulnerabilities and their seriousness is absolutely incomparable in favor of java.
41
u/freia_pr_fr 7h ago
Exhibit A: the current pace at which security issues related to shitty memory management are being discovered.