Brendan (btrotter.delete@this.gmail.com) on July 11, 2021 1:54 am wrote:
> Hi,
>
> cqwrteur (euloanty.delete@this.live.com) on July 10, 2021 6:27 pm wrote:
> > Oh. Modern C++ does not save us. Neither C nor C++ are fixable. Using C or C++ will
> > destroy the earth and kill everyone. Using C or C++ violates human rights.
> >
> > Okay. That is exactly the Rust advocator like you's logic. Alex Gaynor, one of the Rustsec
> > evanglist (who is actually Rust dev) actively pushes Rust into Linux kernel because he
> > treats C and C++ as some kind of great evil like hitler who violates human rights.
> >
> > Right. Clearly Linus Torvalds is the worst human rights violator
> > in the world based on him and people like you's logic.
>
> Let's pretend that you are responsible for Linux and everyone blames you each time a new CVE
> is found; and you want Linux to improve and be the best/most secure kernel it can be.
>
> Let's pretend you started by investigating the causes of the last 200 CVEs, and
> found that there's lots of causes (CPU/hardware bugs that aren't the kernel's
> fault at all, overflows, etc) but "memory safety" is one of the top causes.
>
> Now; what could you do?

But does it matter?
I mean, I believe that "memory safety" is one of the top causes, probably, in top 5 or even top 3, but I don't believe that it accounts for, say, more than 1/5th of all CVEs.
I.e. it warrants attention, but very far from warranting such radical changes in methodology as switch to Rust that very likely has uncountable disadvantages vs current set of tools.