Biden administration calls for developers to embrace memory-safe programing languages and move away from those that cause buffer overflows and other memory access vulnerabilities.

Biden administration calls for developers to embrace memory-safe programing languages and move away from those that cause buffer overflows and other memory access vulnerabilities.

    • PennomiEnglish
      72•1 year ago

      I think that’s the point. You can’t trust the average developer to do things safely. And remember, half of all programmers are even worse than average.

        • PennomiEnglish
          1•1 year ago

          The word “average“ can mean many things, for example, mean, median, mode, or even things like “within 1 standard deviation from the mean”.

          I was using it strictly as the mean which divides the population exactly in half.

        • @Feathercrown@lemmy.worldEnglish
          7•1 year ago

          Bell curves don’t work to make this point. A bell curve is symmetrical, so half of developers will always be below average on a bell curve. But yes, it is true that for other types of distributions, more or less than half of the developers could be below average. What the person above you was looking for, in the general case, would be the median.

        • PennomiEnglish
          2•1 year ago

          The mean is in the center of the bell curve, so I’m not sure what your point is.

          • @thisfro@slrpnk.net
            2•1 year ago

            Average is the mean (i.e. sum of all “skill” divided by the amount of programmers)

            What they were thinking of is the median (50th percentile = 0.5 quantile), which splits the group in two equal sized groups.

            For a bell curve, they are the same values. But think of the example of average incomes: 9 people have an income of 10$, one has an income of 910$. The average income is 100$ ((10*9+910)/10). The median is basically 10 however.

            • @Bademantel@feddit.de
              3•1 year ago

              The distribution of skill in humans, for various tasks and abilities, can often be approximated by a normal distribution. In that case, as you know, the mean is equal to the average.

              • @burlemarx@lemmygrad.ml
                1•1 year ago

                Actually, in order to test your assumption, you’d need to quantitatively measure skill, which per se is something already problematic, but you’d also need to run a statistical test to confirm the distribution is a normal/Gaussian distribution. People always forget the latter and often produce incorrect statistical inferences.

  • @riodoro1@lemmy.world
    32•1 year ago

    Guys, C++ is gonna be dead in a couple of years now. Remember this comment…

    …and read it again in ten years.

    • @ByteJunk@lemmy.world
      3•1 year ago

      Are you the guy who has been posting this same comment every 10 years over the last half century?

      (Edit: is joke)

  • @mlg@lemmy.worldEnglish
    18•1 year ago

    You mean like android running java which is why everyone and their mom bought Israel’s Pegasus spyware toolkit?

    • AggressivelyPassive
      16•1 year ago

      When was the last time you’ve heard of a memory safety issue in Java code? Not the runtime or some native library, raw dogged Java.

      Memory safety isn’t a silver bullet, but it practically erases an entire category of bugs.

      • @mlg@lemmy.worldEnglish
        10•1 year ago

        Fair point, even log4j was running java code, not literally hijacking the stack or heap.

        That being said, I’m poking fun because C and C++ have low level capabilities of which only Rust offers a complete alternative of. Most of everything else is safe because it comes packaged with a garbage collector which affects performance and viability. I think Go technically counts if you set the GC allocation to 0 and use pointers for everything, but might as well use Rust or C at that point.

        I guess I’m just complaining out of all the issues ONCD could point out, they went after the very broad “memeory-safe is always better” when most of the people using C and C++ need the performance. They only offered Rust as a potential alternative in the report with nothing else which everyone already knows. Would be nice to see them make a real statement like telling megacorps to stop using unencrypted SCADA on the internet.

    • @bamboo@lemm.ee
      14•1 year ago

      The apps are (sometimes) Java, but the OS is a mix of languages, mostly C and C++. The Java runtime itself is C++.

    • @Leeker@lemmy.world
      2•1 year ago

      What are you talking about? Did you read the report? On page 7 They directly say that C/C++ “lack traits associated with memory safety”.

    • @ScreaminOctopus@sh.itjust.worksEnglish
      1•1 year ago

      Thats because in government products many unsafe languages shittier than C(++) are used, like Ada, Fortran, and Cobol. It wouldn’t surprise me if most of the code running on products for government use werent written in C or C++

  • @a4ng3l@lemmy.world
    9•1 year ago

    Also like it’s the only source of vulnerabilities… in addition a lot of the trendy python libs are developed in C; do we also ditch those?

  • @Omega_Haxors@lemmy.mlEnglish
    7•1 year ago

    When all the talented programmers are all gay communists and your entire state exists to murder gay communists. Still can’t forget how Allen Turing, a gay man whose inventions were a gigantic help in winning WW2, KYS’d because they still treated him like garbage even after the fact.

  • Treczoks
    6•1 year ago

    Nice. Now I’m waiting for all the Rust or whatever “safe” languages environments for embedded systems to fall from the sky. And please some that actually work on small processors with little memories.

  • @burlemarx@lemmygrad.ml
    3•1 year ago

    People are talking about Java, but the majority of programming languages are memory safe nowadays. Go satisfies this requirement, for example.

  • davel [he/him]English
    -5•1 year ago

    Shut up Brandon, you can’t even code. This is just propaganda from Big Rust.