undefined | Better HN

0 pointssteveklabnik1y ago0 comments

It is true that they are different, but also, given the significant overlap between the two, people will reasonably talk about them together.

0 comments

Wumpnot1y ago

From a safety perspective they aren't very close, there is a reason that all these CVE bugs are C code.

steveklabnikOP1y ago

I haven't seen conclusive evidence that this is the case, do you happen to have an analysis of this somewhere?

Of course, C++ offers you tools that C doesn't, but some of those tools have their own sharp edges as well. Plus, many C++ codebases are "C with classes" style or similar hybrids, those are still ultimately C++ programs, not C ones.

GoblinSlayer1y ago

Counterexamples would be s2n, grpc, putty, postfix, that are either C with classes or non-PDP C. I suppose in postfix security design was an afterthought and added gradually, but at least it was thought.

1 more reply

pjmlp1y ago

If the code compiles with a C++ compiler, for better or worse it is C++ as well, might be C style C++ code, which is nonetheless part of the grammar, semantics and libraries defined by ISO C++ standard.

And that is the deal, lack of security culture.

j / k navigate · click thread line to collapse