Anon (no.delete@this.spam.com) on July 13, 2021 11:31 pm wrote:
> cqwrteur (euloanty.delete@this.live.com) on July 13, 2021 10:16 pm wrote:
> > The largest reason why C++ is not safe (although it is much
> > safer than C) is because of object-oriented programming.
>
> Sure, using str* functions is much safer than using std::string...
>
> > Type confusions, vptr injection or recent new fancy "COOP" (counterfeit object-oriented programming) attack.
> >
> > https://www.youtube.com/watch?v=NDt7Tholxp4
>
> Oh, an attack that is only possible because: C++ does not enforce memory safety! The video
> is an argument against everything you are talking about, not in favor, use a memory safe
> language and such attack would be impossible, not just that attack, but you would prevent
> other attacks such as https://en.wikipedia.org/wiki/Stack_buffer_overflow
>
> > You want me to show Rust?
> >
> > https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=rust
> >
> > CVE-2020-25575 ** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered in the failure crate
> > through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and
> > has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products
> > that are no longer supported by the maintainer. NOTE: This may overlap CVE-2019-25010.
> >
> > CVE-2019-25010 An issue was discovered in the failure crate through 2019-11-13
> > for Rust. Type confusion can occur when __private_get_type_id__ is overridden.
>
> Oh, so a bug in an abandoned package, wow.
>
> Really, stop, this is ridiculous, people should be laughing on you now, stop to preserve some respect.
>

It is actually laughable your precious C lang cannot even have any bounds checking (not even _GLIBCXX_ASSERTIONS), nor RAII nor EH. With all sorts of goto + ugly.


https://www.msn.com/en-us/money/news/top-programming-languages-c-and-java-remain-tops-as-python-surges/ar-AALQjie

C++ is actually not even the 2nd, it is the 4th. Guess what, java and python are the 2nd and 3rd.

You do think C++ is no better than C for security? 50% of CVEs are in C code dude.


You mean other languages besides C++? I believe I can find a lot if I have time.

For example, what about java?
http://schierlm.users.sourceforge.net/TypeConfusion.html