Hacker News Reader

Comment by raverbashing | Hacker News Reader

Because your code has bugs and/or security vulnerabilities. It's pretty safe to assume this without looking at your code

View on HN

Heh, so does yours. I can say this without even knowing what language you use to write your software, much less looking at it... All software has bugs, and most of those are security vulnerabilities waiting to happen.

Of course. Code is hard.

Using a safer language makes it easier and less prone to out-of-bounds memory accesses.

By using C/C++ you're choosing to make a hard problem harder.

C++ does have a practical, memory-safe subset[1]. Recommended for anyone writing internet facing C++ code.

[1] shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus

And slower or impractical even for some things. Maybe we should write a real-time media codec in python 'cause security. I don't understand why you, like the OP, make these sweeping generalizations as though all of engineering is black and white. Sometimes, I reach for a higher abstraction, sometimes not. It depends on the problem domain.

Oh and btw, "out of bounds memory accesses" are not the primary source of security vulnerabilities at all. In fact, such out of bounds access is more likely to just make your program crash (which is a good thing).

I wouldn't be so sure lower level code necessarily has more vulnerabilities. It's certainly easier to find the vulnerabilities because the attack vectors are well-known.

Software written in higher level languages is often less widely deployed, so less people are trying to find vulnerabilities. All the complexity adds up, and can result in new vulnerabilities that wouldn't have been there if the code was written in a simpler language.

What complexity adds up?

Reply on news.ycombinator.com