Alex Gaynor

They linked directly to https://alexgaynor.net/2019/apr/21/modern-c++-wont-save-us/ which did exactly what I'd guessed as its example: > The following code for example, simply returns an uninitialized value: #include <optional> int f() { std::optional<int> x(std::nullopt); return *x; }

Highly recommend Alex Gaynor's intro to memory unsafety https://alexgaynor.net/2019/aug/12/introduction-to-memory-unsafety-for…

For the record, it's worth noting that we're starting from a state that's nothing short of disastrous: https://alexgaynor.net/2014/nov/12/state-of-news-tls/ Let's hope that twelve months from now, we're looking at a very different landscape. Kudos to NYTimes for issuing the challenge. At the very least, this is an important conversation starter.

This is a full writeup: http://alexgaynor.net/2011/apr/03/my-experience-computer-language-shoo… You're correct, I got my facts wrong. We were allowed to use ctypes for gmpy, but not for something else. We weren't allowed to submit a ctypes-using and array-using benchmark that didn't work on CPython due to a CPython bug. the end result of us trying to be slightly better was that we ended up being kicked and a few other people ended up being kicked as well, though they weren't really guilty. Overall the experience was that the results are not "fair" and are guarded by arbitrary rules that are not really written anywhere. One of those rules is that an arbitrary (typically most popular, but not necesarilly so) implementation is only allowed. This makes it much less trustworthy that it can actually be.

Both. On the one hand, what Rust essentially forces you to do is just to program according to proper RAII principles that an experienced C++ programmer would already know and should already be using (especially once polonius lands), it's just better at checking failure to do so than any sanitizer or linter could ever be, so it's a way to avoid having to deal with annoying, hard to track down memory bugs. And in fact, the greater confidence static lifetime guarantees give you allows you to do things like using move semantics more where C++ programmers would have to use copies out of defensive programming. That's predominantly why I personally use it, as far as memory safety goes. On the other hand, [around 60-70% of serious security bugs have been proven to be caused by memory safety across many different projects](https://alexgaynor.net/2020/may/27/science-on-memory-unsafety-and-secu… so if you do care about security in what you're doing, it's a boon there too.

Agreed about the inability to write C, but the part about C++ is simply not true. I don't know about "better" in the general sense, but for the specific use case of the Linux kernel, Linus has identified some entirely reasonable objections (though aggressively worded) to C++: https://lkml.org/lkml/2004/1/20/20 - the whole C++ exception handling thing is fundamentally broken. It's _especially_ broken for kernels. - any compiler or language that likes to hide things like memory allocations behind your back just isn't a good choice for a kernel. - you can write object-oriented code (useful for filesystems etc) in C, _without_ the crap that is C++. Those objections do not apply to Rust, which avoids exception handling, avoids implicit allocations, and has a much smaller OO system that resembles what the kernel does for filesystems. Those objections continue to apply to C++. There are good, principled reasons to accept Rust and continue to reject C++. (There are also good reasons to believe that C++ doesn't solve any of the problems with human inability to write correct C, meaning that it wouldn't be worth the cost of adding a new language: https://alexgaynor.net/2019/apr/21/modern-c++-wont-save-us/)

Currently python 3 packages ported are at about 10.9% according to pypi. This isn't including separate source downloads, so I guess the number would be higher by a few percentage points. There was a post by Alex Gaynor in January [0] about downloads for python 3 being at 2.4%. But that was before python 3.4 came out, and before some major libraries were finally ported like Twisted. Twisted not being ported was one of the main blockers for python 3 in the last Ubuntu release [1]. Once more distros improve their python 3 support, things will get exponentially better for python 3. Continuous integration servers inflate numbers because they re-download things, and there is the CDN which makes all these numbers highly inaccurate. Lots of things have been ported since January, like pycurl, pyOpenSSL, bugzilla [2], etc. Because of the big pushes by Debian, Ubuntu, Fedora, Mozilla, and Gnome [3] communities amongst many others. Things have improved greatly in a few months. Distros, and apps like Sublime Text 3 moving to python 3, along with some of the major missing pieces will help uptake significantly. Almost all packages in Fedora come with python 3 packages now. But the key to increasing python 3 adoption is Apple, and python 3 on OS X. Many of the python packages that come with OS X are now ported to python 3 (Twisted, cups, pyobjc, etc) ... but who knows what they have planned? I guess we'll see June-ish. [0]…

Hmm my reasoning was that in order to have Nginx work in Rust you want to expose scripting so having a decent Lua in Rust is key to not call out to C for that. And then Valkey/ Redis is a lot simpler than nginx so it was a good way to learn how some of this works. And I'd disagree on no one wants - Lua is quite helpful since it is easily used in WASM. There has been some interest from people in the Bevy community - a game engine in Rust - since you can't have Lua scripting in browser games easily with the C version. But anyway if people want it or not memory safety might become much more important so I think it is a good area to explore. Some people think large C codebases are inherently unsecurable https://alexgaynor.net/2020/may/27/science-on-memory-unsafety-and-secu…

It is discussed in the linked post: https://alexgaynor.net/2019/apr/21/modern-c++-wont-save-us/ tl;dr: use-after-move, or dereferencing null.

You didn't read this, did you? https://alexgaynor.net/2019/apr/21/modern-c++-wont-save-us/ It's not a pointer.

This hasn't been considered well-regarded for a very long time. I'd say the opposite is dogmatic: we're in a post-Postel world[1], in part because of observed security failures over the last 30 years. [1]: https://alexgaynor.net/2025/mar/25/postels-law-and-the-three-ring-circ…

No, they're not. People talk about LLM-generated code the same way they talk about any code they're responsible for producing; it's not in fact the norm for any discussion about code here to include links to the code. But if you're looking for success stories with code, they're easy to find. https://alexgaynor.net/2025/jun/20/serialize-some-der/

Do either of these impress you? https://alexgaynor.net/2025/jun/20/serialize-some-der/ - using Claude Code to compose and have a PR accepted into llvm that implements a compiler optimization (more of my notes here: https://simonwillison.net/2025/Jun/30/llvm/ ) https://lucumr.pocoo.org/2025/6/21/my-first-ai-library/ - Claude Code for writing and shipping a full open source library that handles sloppy (hah) invalid XML Examples from the past two weeks, both from expert software engineers.

It won't prevent all, but may prevent many. Quote: If you have a very large (millions of lines of code) codebase, written in a memory-unsafe programming language (such as C or C++), you can expect at least 65% of your security vulnerabilities to be caused by memory unsafety. The quote is from https://alexgaynor.net/2020/may/27/science-on-memory-unsafety-and-secu…

Read this: https://alexgaynor.net/2019/apr/21/modern-c++-wont-save-us/ It will help you understand why "smart pointers" still won't help you.

It's because we're dealing with an extreme example in which a program's safety depends on the resolution of an open problem. If the program's safety depends on the semantics of C and how they've been used in a function, it will be possible to deal with all the conditions upon which a program could be unsafe (in the sense of the standard safety vulnerabilities – like those listed here [0]). Doing so would lead to denouement, so that the annotation to the main function would be empty (meaning none of those bugs can occur). Programs that might be unsafe should not be verifiable. [0]: https://alexgaynor.net/2020/may/27/science-on-memory-unsafety-and-secu…

Compiler optimizations and other forms of UB like integer overflow would like a word with you. If it were that simple, someone would have had success at scale by now https://alexgaynor.net/2020/may/27/science-on-memory-unsafety-and-secu…

> C++ is not a runaway nuclear fire which contaminates and melts everything around it when it comes to sanity and security. Not sanity, maybe. But security? How much more would it take to declare a nuclear meltdown: https://alexgaynor.net/2020/may/27/science-on-memory-unsafety-and-secu…

> Most Citation needed. Log4j comes to mind as a logic bug disaster, but all the data I've seen is that >65% of the high severity bugs come from memory unsafety in most software projects. https://security.googleblog.com/2022/12/memory-safe-languages-in-andro… https://alexgaynor.net/2020/may/27/science-on-memory-unsafety-and-secu…

I think you underestimate memory errors. In large C and C++ projects, ~70% of discovered security vulnerabilities have memory errors as their cause. Source: https://alexgaynor.net/2020/may/27/science-on-memory-unsafety-and-secu… On the other hand, Google reports that "to date, there have been zero memory safety vulnerabilities discovered in Android’s Rust code." Source: https://security.googleblog.com/2022/12/memory-safe-languages-in-andro…

Memory safety is literally the only relevant topic in this whole thread whose impact isn't "truthy" in that sense! We can measure how many bugs and security vulnerabilities in real projects are memory issues, and we know that a memory safe language would rule those bugs out by construction. And we have! This blog post[1] is a good starting point, linking to a number of studies. Empirical evidence is never perfect, but that's much stronger evidence than we have for the impact of pretty much any other aspect of a programming languages! [1]: https://alexgaynor.net/2020/may/27/science-on-memory-unsafety-and-secu…

Turns out, it is: https://alexgaynor.net/2019/apr/21/modern-c++-wont-save-us/

Many organizations have independently converged on memory safety being responsible for roughly 70% of vulnerabilities. So yes, still relevant and still a problem for users. https://alexgaynor.net/2020/may/27/science-on-memory-unsafety-and-secu…

Rust has a few interlocking behaviors that provide its memory safety, a few of the most important are: - The borrow checker enforces mutable XOR shared references. - The compiler does not allow use of local variables before they're assigned to, requires structs to be completely initialized, etc.. - All the builtin datastructures perform bounds checks - The compiler disallows deferencing raw pointers except in unsafe blocks. There's a lot of good things to be said about modern C++, particular smart pointers. However, it's significantly less resilient to common mistakes than Rust is: https://alexgaynor.net/2019/apr/21/modern-c++-wont-save-us/

Because modern C++ won't save us: https://alexgaynor.net/2019/apr/21/modern-c++-wont-save-us/

Here's one: https://alexgaynor.net/2019/mar/07/chrome-windows-exploit-security-bey… You're sacrificing a lot of security by staying on Windows 7. It doesn't have nearly the level of modern kernel hardening features that newer versions have.

No there isn't. People used to be able to extrapolate it from the pypi downloads stats (like this: https://alexgaynor.net/2014/jan/03/pypi-download-statistics/), but sadly it's not possible anymore.

Didn't the PyPy folks have some issue with the language shootout, which led them to make their own?[1][2]. IIRC a lot of the Python code wasn't that optimized at all compared to the C/C++ programs. 1. http://speed.pypy.org/ 2. https://alexgaynor.net/2011/apr/03/my-experience-computer-language-sho…

Neither downloads of PIP, nor packages in PyPI. I was talking about versions of Python used to download packages off of PyPI (with pip et al). As of 2014/1, those accounted for < 5% of the downloads, with 2.X being the rest: https://alexgaynor.net/2014/jan/03/pypi-download-statistics/

There's a wrapper for CPython to get it to implement the tracing code, afl-python[1]. Alex Gaynor did a basic intro to it a few days ago which is a better write-up that the project itself has! Of course, this doesn't work so well with mixed C/Python code. [1]: https://bitbucket.org/jwilk/python-afl [2]: https://alexgaynor.net/2015/apr/13/introduction-to-fuzzing-in-python-w…