I don’t disagree with these points in general. However this isn’t simply about the tools. Tools go along with people and their skill and experience. There are developers and developers. There are people with lots of experience who create much higher quality C code than others. Personally I’d never touch C if I can avoid it as I don’t trust myself as much. I’d always go for C++ instead. Modern C++ with RAII is great. It’s what most of the software at our corpo is written in. Maybe Rust would end up becoming the default standard at some point. Maybe something else would. I would never go shit on a coworker who has produced tons of well functioning code that they better reskill in something that may or may not stick around, or that they may not become as productive with for a long time. A team skilled in C or C++ may be able to produce higher quality software, quicker than a less skilled team Rust. Rust might be better for teams that just start in native programming. I don’t know. If it grows enough in use, reskilling people and reworking software to cooperate with it might become an obvious choice. For now, as I see it, it depends on the team.
And I dont deny that. There are a lot of programmers, and not all had eduction on designing secure software. Even with the knowledge and experience, what if the programmer is tired or makes a similar mistake. Only one mess-up away from a potential vulnerability or instability of the app and system as a whole. I need more experience with C to form a better opinion.
This is why security is usually multi-layered - decrease the chances of a single fuckup compromising everything. And yes using a safer language adds a layer. But typically it won’t be the only layer.
I don’t disagree with these points in general. However this isn’t simply about the tools. Tools go along with people and their skill and experience. There are developers and developers. There are people with lots of experience who create much higher quality C code than others. Personally I’d never touch C if I can avoid it as I don’t trust myself as much. I’d always go for C++ instead. Modern C++ with RAII is great. It’s what most of the software at our corpo is written in. Maybe Rust would end up becoming the default standard at some point. Maybe something else would. I would never go shit on a coworker who has produced tons of well functioning code that they better reskill in something that may or may not stick around, or that they may not become as productive with for a long time. A team skilled in C or C++ may be able to produce higher quality software, quicker than a less skilled team Rust. Rust might be better for teams that just start in native programming. I don’t know. If it grows enough in use, reskilling people and reworking software to cooperate with it might become an obvious choice. For now, as I see it, it depends on the team.
And I dont deny that. There are a lot of programmers, and not all had eduction on designing secure software. Even with the knowledge and experience, what if the programmer is tired or makes a similar mistake. Only one mess-up away from a potential vulnerability or instability of the app and system as a whole. I need more experience with C to form a better opinion.
This is why security is usually multi-layered - decrease the chances of a single fuckup compromising everything. And yes using a safer language adds a layer. But typically it won’t be the only layer.