Hacker News Reader

Comment by moonshinefe | Hacker News Reader

Because a large portion of massive security holes in recent history have been due to archaic C libraries that have security holes a-plenty. A lot of these issues that plague C don't happen in modern languages.

It's 43 years old (times have changed), and while I'm sure C still has its places, I think it's time to come to terms with the fact that people suck at handling memory manually and making sure type conversions are safe & a host of other security risks.

Other, safer languages can accomplish many of the same things C does these days.

Again, I'm not calling for the end of C, but in a lot of situations, it's just asking for it now.

View on HN

There is a slightly disingenuity here. "a large portion of massive security holes in recent history have been due to archaic libraries that have security holes a-plenty".

The fact they are also C libraries is because that was the only real option of the time when they were written; rather like saying most car accidents were caused by black ones when the only option was a model T.

It is not true.

Before C escaped UNIX there were other systems programming languages available.

The manner in which it escaped Unix was through Microsoft and Borland, and I spent oodles of time evaluating other choices at the time. I could not get the boss to buy Ada, and everything was a compromise. Borland 'C' was super cheap and 100% available, as was Microsoft 'C' before it.

I kind of disagree.

Turbo Pascal and Apple Pascal ruled back then, at least in Europe. On Apple's case it was even the main OS language.

However with UNIX being adopted at work and universities, many wanted to be able to transport their work between home and work/uni. So people started to slowly adopt C.

I followed the same pattern with C++. Eventually Turbo Pascal wasn't no longer an option, so started using Turbo C++, C was just too primitive and unsafe already back then, vs TP.

At least C++ had some of the safety features I was used from TP, as long as one stayed away from C style coding.

Turbo Pascal was common before Turbo 'C' in the US as well. I personally was rather relieved to change from Pascal to 'C'. It's possible that that transition helped me to understand how to use 'C' safely.

With Pascal, I recall having to use more assembler.

I would say that from my vague memories, Turbo C 2.0 wasn't much different from Turbo Pascal 5.x and 6.0.

I had to use Assembly in both cases.

I was writing protocol drivers, and 'C' is better for that.

So don't use those parts of the library. We actually kept a mock-stub library to link against with the Bad Things missing to check before a release at one place. It was actually one object file and I dunno... 150 lines of 'C'?

I despair that "people suck at handling memory manually" :) It's not that hard, folks...

Reply on news.ycombinator.com