Hacker News Reader

Comment by hardware2win | Hacker News Reader

He doesnt like NSA calling C CPP unsafe cuz CPP is way safer than C and the fact that lang committee wasnt asked about their assessment. Then he recommends reading CPP safety guidelines and links some CPP proposals to make lang better. Also reminds that there various kinds of safety and trade offs.

I think guidelines are poor ass method to improve security, especially when you can see that projects like Chromium still have a lot of mem. related safety.

View on HN

> projects like Chromium still have a lot of mem. related safety.

Chrome might suffer from being a Google project. At least the old Google C++ style guides heavily pushed a C with classes approach and where outright hostile to every improvement over C new versions of the language brought along.

My guess is the reason is C++ is complicated.

When you have restrictive conventions, it is easier for a new dev to get onboard, as well as for creating static analysis tools.

Google C++ forbids exceptions, but C++ RAII works a lot better when a data member ctor can throw. The compiler will generate code tearing down a half-constructed object from that point, without you having to write a method that knows what to do and what not to.

What percentage of CVEs in Chromium are caused by half-complete objects where a constructor throw would have prevented the issue? I certainly don't have an exhaustive view of things but no example is coming to mind right now. With [[noexcept]] everywhere I'd expect a constructor failing to just crash Chrome rather than proceed in some indeterminate state.

https://google.github.io/styleguide/cppguide.html#Exceptions calls for factories or init methods (probably returning error codes) so running with an invalid state isn’t prevented by terminating the process.

I don’t have access to CVEs on crbug.com but the top two from https://chromereleases.googleblog.com/2023/01/stable-channel... are a use-after-free and buffer overflow reported months ago, which is the kind of stuff that modern C++ tries to avoid using containers and smart pointers with RAII.

Of course modern C++ tries to avoid this sort of thing now with smarter lifetime management, but what does that have to do with building with exceptions disabled?

I think they use their own containers and smart pointers which require explicit initialization (more scope for mistakes), to avoid standard C++ classes whose copy/move ctors can throw.

Yeah, that gripe about the C++ standards committee not being consulted is a bit petty. It's likely the NSA didn't consult ~any language maintainers; there is plenty of error rate data coming out of large corporations to go on.

Reply on news.ycombinator.com