Comment by applfanboysbgon
15 hours ago
> Rust is ~0.2 vulnerabilities per MLoC. Java is effectively 0. C and C++ both seem to be about 1,000 vulnerabilities per MLoC. Zig is too new and hasn't had any analysis done on it, but generously it's likely at least 10-100.
You have just described six orders of magnitude in your attempt to rebut pron pointing out the four languages have four levels of memory safety.
"two things are within an order of magnitude, and two other things are within an order of magnitude, and those two groups are three orders of magnitude apart" does sound like two groups to me.
> those two groups are three orders of magnitude apart
They aren't necessarily, though. Supposing that Zig were "10 issues per MLoC" (with just as much handwaving as the original poster), it would be equidistant from Rust and C. Java may also be more than one order of magnitude away from Rust; we say ~0 but is it 0.01, 0.001, 0.0001...? And why is "1 issue per MLoC" the acceptable metric that delineates what constitutes table-stakes memory-safe language? Because it's a nice, round-sounding number? I think 0 is a nicer, rounder number than 1, so let's call only Java table stakes and condemn all other languages to the garbage bin, tradeoffs be damned. Or would you say your arbitrary delineation point is worth more than mine?
You’re making an assumption based on zero information in a very favorable to zig way. When you have no information it’s best to rely on good priors grounded in what you do know.
zig as a language not distinguishing between safe and unsafe. Zig does not forbid unsafe. Zig’s safety model is conceptually not too different from running with ASAN for C/C++ during development. Given that’s already a followed “best practice” for the data that was used to come up with the vulnerability estimate per MLoC for C and C++ it’s reasonable to assume zig is closer to that side (at scale) than to Rust. You could argue defer as a keyword is worth a 10x improvement but even then im not sure how considering c and c++ are close and c++ does essentially a similar thing
> Or would you say your arbitrary delineation point is worth more than mine?
Yes for the reasons I already gave. I think that at the point that you're having to stretch the numbers from their post to the breaking point to remove the pretty clear order of magnitude differences it's not really a constructive way to engage.
I think you have two groups with one at ~.1 and one on ~100. You seen to either disagree with that, or think it doesn't matter, I'm not sure which. But taking that assumption as true it is self evident that the 3-order-of magnitude demarcation is not arbitrary.
3 replies →