uecker

It is impossible to interpret this number (271) without looking into details. People certainly found plenty of memory safety and others bugs in Rust projects in the past, so I do not understand you cl…

There exist memory safety bugs in Rust projects, so you will find them. Or maybe not with AI, as there is not enough training data? The 70% number google claims is either BS or google-specific as othe…

I was not talking about curl, but the downstream products such as cars. And I am sure curl would appreciate support from car vendors, this was the point wasn't it?

As long as the memory-safe subset of Rust is used exclusively.

It talks about "installing software". You should definitely install updates from your Linux distribution and installing new packages from a curated repository is certainly not worse than hav…

I am not talking about the open-source projects, but the downstream products such as cars that integrate curl.

The solution exists, and those are curated package repositories as we have in Linux distributions. In C I can simply install a -dev package and use some library which sees some quality control and se…

The problem is that they get away too easily with bugs in their products they ship to customers. If this would come with some penalties, there would be some incentive to invest in security and this wo…

I was disagreeing with the statement that a "serious" language needs to have this hard-coded. think the C model where you can have the strictness if one wants to, but one can also opt-out is…

It is wrong that signed types in C implement modular arithmetic. They have undefined behavior on overflow.

Any reasonably good C code I ever worked with aimed to be warning free. But yes, if you can also make it an error. The flexibility is important though.

You should know that the type is promoted to int first, which is also what makes your example work. This is what happens when you perform the computation using an non-promoting 8 bit unsigned type: h…

This was not the original claim in the thread I responded to which as "even with a dynamically typed language, you can keep escaped strings as an Escaped class, with escape(str)->Escaped and d…

They described the use of abstract data types. One can certainly use those in most languages - for sure in C.

Singed integers in C do not implement modular arithmetic. You can trust me on this.

The point is that you can get the warnings without having to deal with a strict type system all the time.

That depends. But some sanitizer are cheap enough that you can usually always run them. Regarding infinite loops, C++ and C differ with C++ being more aggressive. But also compilers differ with clang …

It was added, but immediately after the rest. I was just quickly refreshing my memory on what Rust was doing. I think it is a terrible design. If you want special function which protects you from erro…

I am not convinced. A byte is for low-level accessing of memory, you shouldn't really do any computation with it, except maybe low-level bit-fiddling or crypto, but then the non-wrapping non-nega…

What the parents describe can be done with almost any language.

Unsigned is certainly a misnomer for a wrapping type. That does not mean it is a type design mistake. And I agree that people should not use it much. But what I do not believe is that there is a real …

You can have the trap during production, and then it is safer. If you need to catch the problem at run-time, there are checked integer options in C that you can use.

It is not even possible to do arithmetic on char in C.

For signed overflow we have sanitizers, and for conversions C compilers warnings in C. Bounds checking can also be done with sanitizers (but is a bit more tricky). So no, I do not think the undefined …

In C your compiler can help you with conversions and if not, please use a better one. In this regard, C is a very pragmatic language, and hence for actual work it is a more "serious" progra…

It is interesting that you find unsigned integers more intuitive. My experience (also with students, but also analysis of CVE give plenty of evidence) is that the opposite is true: signed integers in …

My copy of K&R already has unsigned modulo arithmetic: "unsigned numbers are always positive or zero, and obey the laws of arithmetic modulo 2n, where n is the number of bits in the type.&qu…

Not sure what change in the C standard you mean. unsingned was always modulo. Otherwise, use -Wsign-conversion.

the reason is not that you want a negative index or size, but that you want the computation of the index to be correct, and you want to have obvious errors. Both turns out to be easier with signed ty…

Having them available is not the issue, using them for sizes and indices is what causes a lot of tricky bugs.