Hacker News Reader

Comment by voxelghost | Hacker News Reader

If user(programmer)-behavior is the main problem, and there is claim to a safe C++ subset, then wouldn't it make sense to implement an UNSAFE compiler attribute macro, to enable the unsafe features, while turning them off in default compilation mode for new versions of C++?

View on HN

There's no unsafe keyword, but most modern C++ people know what is intended to be safe and what isn't, i.e. unique pointers, raii, and bounds-checking accessors. It isn't going to be as strict as Rust, but you get a lot of benefits.

Knowing some Rust and how it works, then going back to C++ can help you recognize where to use safer idioms and what's potentially dangerous.

I know there is no unsafe keyword, but I was suggesting one should be added.

I am a bit rusty (no pun intended) at the moment, but I have decades-long experience with C++, but not all people do, and all people ,even experienced developers make mistakes or get lazy and take the easy way out from time to time.

I think one lesson C++ could take from rust, if nothing else, is that clearly demarking unsafe code sections is beneficial in and of itself.

If Strostrup makes the claim that developers using old C features is the main security problem of modern C++ , then an unsafe keyword would guide behavior towards safe usage.

    #No "old unsafe C" here

    UNSAFE{
    #Full C++, including "old unsafe C" here
      ...
    }

    #No "old unsafe C" here


    >c++                / treat code as "New Safe C++ only", except for UNSAFE sections
    >c++ --no-unsafe    / treat all code as "New safe C++ only"  UNSAFE not allowed
    >c++ --allow-unsafe / current behavior, allow all C++ including "old unsafe C" in all sections

Microsoft is thinking down those lines given, see their "-memory-safe C++" talk at CppCon.

https://www.youtube.com/watch?v=ml4t-6bg9-M

However, this is only one compiler, not ISO C++.

You can still have rogue references to deleted objects in such a situation, or invalidated iterators, or plenty of other undefined behaviors even using just modern C++ features.

Reply on news.ycombinator.com