Comment by dns_snek
2 days ago
> memory safety might be the difference between the software engineering and Software Engineering. As in, an actual Engineering discipline.
I wouldn't go that far, what matters is the finished whole. Memory safety of the finished program is a critical factor and using a memory safe language makes it easier to achieve that goal.
However simply using a memory safe language doesn't make you a "Software Engineer" any more than using a certified I-beam makes someone a "Civil Engineer". What matters is that the finished structure/program meets the explicit and implicit requirements of safety, functionality, durability, cost, etc.
Not to mention that complex reliable systems are usually engineered out of much less reliable components.
Overall safety matters. Memory safety is just one factor. Log4Shell happened in Java, a GC language without pointer arithmetic.
Using seat belts is just one factor. People still die while wearing one, so it should not be compulsory.
Is how this kind of arguments always get received by security folks.
With Fil-C and Rust the memory safety shouldn't even be discussed. It should be the bare minimum.
Presence of worse bugs won't make memory bugs disappear.
Necessary versus sufficient condition, as they say in philosophy.