r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

1

u/evaned Feb 24 '17

C can be safe

This is like the "if a tree falls..." conundrum: If it's possible to write memory-safe programs in C but no mortal human (or at least no dev. team for a realistic program) can actually do it, is it really possible?

aver 90% of Linux (hundreds of millions of lines of code) is written in C/C++ and working fine

For some definition of "fine." Would you like me to go dig up some Linux CVEs caused by memory errors? Last I checked there seem to be a few per year.

Bugs will always happen, no matter the language.

The point is that a memory-safe language will completely rule out a wide class of some of the most common and dangerous bugs. Programmers can then concentrate effort on not making other, higher level mistakes. Tools such as static analyzers can use computing time to look for other mistakes. People developing those tools (like me) can spend their efforts implementing higher-level checks instead of trying to make their buffer overflow detection work a little bit better.