Hacker News Reader

Comment by zozbot234 | Hacker News Reader

> While I know and respect many people who have worked on C++ and contributed to it, we need to move on from it.

This has largely happened already. Java is in fact a memory safe language which has replaced a whole lot of C++ code since the late 1990s. It's only in a few highly performance-oriented areas where the debate ("should we be replacing C++ with a memory safe language?") is still undecided.

View on HN

Java may be memory safe, but errors in highly expressive functionality like Java serialization and expression parsers have been responsible for some of the most impactful vulnerabilities in recent memory.

CVE-2017-5638 was famously exploited to gain access to Equifax's network and cause a massive data breach. Log4Shell is continuing to cause problems in all kinds of networks due to the extremely widespread use of the Log4j library. Java is definitely an upgrade over C/C++, but there are definitely still security risks.

When we eliminate 70% of CVE, it doesn't mean the remaining 30% shouldn't be taken care of.

So then memory safety isn't the end-all be-all for security anyways. What do you suggest we use instead?

Coq

Ada?

Ada/SPARK

That is not the case in my experience. There are still plenty of C++ codebases that don't need the extra performance over something like Java or care about GC pauses.

C++ continues to be popular because it's a powerful language and can easily integrate with a ton of libraries, and most people don't care much about security.

Reply on news.ycombinator.com