<story><title>Nvidia Security Team: “What if we just stopped using C?”</title><url>https://blog.adacore.com/nvidia-security-team-what-if-we-just-stopped-using-c</url></story><parent_chain><item><author>P5fRxh5kUvp2th</author><text>Our industry went through this with the move to Java (and later .Net).&lt;p&gt;&amp;quot;It will solve memory leaks!&amp;quot;&lt;p&gt;...&lt;p&gt;&amp;quot;whoops, you can still leak memory in garbage collected languages, my bad everyone!&amp;quot;.</text></item><item><author>zamalek</author><text>&amp;gt; Believing that all software security problems would be solved if we got rid of C is a bigger disease than C itself.&lt;p&gt;Getting rid of a class of errors (correctness) allows you to focus more on other errors (logical). It could be argued that it could slightly reduce the likelihood of the latter.</text></item><item><author>delusional</author><text>Believing that all software security problems would be solved if we got rid of C is a bigger disease than C itself. I work in a fairly large (for my country) financial institution and the problems we deal with on a day to day basis are so far removed from buffer overflows that it&amp;#x27;s not even funny.&lt;p&gt;We still have software running in excel macros that control web browsers via COM. C is nothing compared to the attack surface of that.</text></item><item><author>docandrew</author><text>C is like asbestos. It was fine at what it did, good performance, but the safety problems outweigh them. The difference is that we _stopped using asbestos_ because it was unsafe. It’s still around but being replaced during renovations, and no new installations use it.&lt;p&gt;For whatever reason with C there’s this huge emotional component to it. Safer alternatives exist. You’d rightfully laugh at a contractor who suggested asbestos is fine, if you make sure to use only highly-skilled installers who patch up the drywall so that no fibers can escape. But with C we say that all the time, and the CVEs keep piling up.</text></item></parent_chain><comment><author>adgjlsfhk1</author><text>ditching C doesn&amp;#x27;t solve memory leaks but it does solve use after free. A memory leak is a performance problem that isn&amp;#x27;t generally exploitable. A use after free is almost always a security vulnerability.</text></comment>
<story><title>Nvidia Security Team: “What if we just stopped using C?”</title><url>https://blog.adacore.com/nvidia-security-team-what-if-we-just-stopped-using-c</url></story><parent_chain><item><author>P5fRxh5kUvp2th</author><text>Our industry went through this with the move to Java (and later .Net).&lt;p&gt;&amp;quot;It will solve memory leaks!&amp;quot;&lt;p&gt;...&lt;p&gt;&amp;quot;whoops, you can still leak memory in garbage collected languages, my bad everyone!&amp;quot;.</text></item><item><author>zamalek</author><text>&amp;gt; Believing that all software security problems would be solved if we got rid of C is a bigger disease than C itself.&lt;p&gt;Getting rid of a class of errors (correctness) allows you to focus more on other errors (logical). It could be argued that it could slightly reduce the likelihood of the latter.</text></item><item><author>delusional</author><text>Believing that all software security problems would be solved if we got rid of C is a bigger disease than C itself. I work in a fairly large (for my country) financial institution and the problems we deal with on a day to day basis are so far removed from buffer overflows that it&amp;#x27;s not even funny.&lt;p&gt;We still have software running in excel macros that control web browsers via COM. C is nothing compared to the attack surface of that.</text></item><item><author>docandrew</author><text>C is like asbestos. It was fine at what it did, good performance, but the safety problems outweigh them. The difference is that we _stopped using asbestos_ because it was unsafe. It’s still around but being replaced during renovations, and no new installations use it.&lt;p&gt;For whatever reason with C there’s this huge emotional component to it. Safer alternatives exist. You’d rightfully laugh at a contractor who suggested asbestos is fine, if you make sure to use only highly-skilled installers who patch up the drywall so that no fibers can escape. But with C we say that all the time, and the CVEs keep piling up.</text></item></parent_chain><comment><author>bcrosby95</author><text>Both a paper cut and a gunshot wound bleed.  It doesn&amp;#x27;t make them equal.</text></comment>