I wonder why C and C++ are usually regarded as equally insecure. In C you need to carefully check that you free allocated memory, and that you don't use it after you free it. In C++ this is automated by using classes like std::string and std::vector, once they go out of scope their memory is freed and you can't use it anymore. It is still possible, e.g. by using a for loop that iterates over a vector, and removing or adding stuff to that same vector in that loop. But my rough estimate is that such errors are at least ten times less likely in C++.
I develop in C++ for a job, and when I need to use a library written in C I always have a bad feeling about it.
> I wonder why C and C++ are usually regarded as equally insecure.
They aren't, usually.
C++ has all the C problems, and multiples more on top of those. It's a broad attack surface - literally no one is going to claim to be proficient in every single C++ feature available to their compiler. It's also quite opaque to visual inspection (making double-checking with an LLM difficult as it needs whole-program reasoning instead of localised reasoning).
One of those languages is one of the most complex programming languages ever invented, with the largest breadth of features, any of which may interact with any other feature in subtle ways.
The other is one of the most minimalistic languages created, with a dev able to keep the language standard in their head for the most part.
I wonder why C and C++ are usually regarded as equally insecure. In C you need to carefully check that you free allocated memory, and that you don't use it after you free it. In C++ this is automated by using classes like std::string and std::vector, once they go out of scope their memory is freed and you can't use it anymore. It is still possible, e.g. by using a for loop that iterates over a vector, and removing or adding stuff to that same vector in that loop. But my rough estimate is that such errors are at least ten times less likely in C++.
I develop in C++ for a job, and when I need to use a library written in C I always have a bad feeling about it.
> I wonder why C and C++ are usually regarded as equally insecure.
They aren't, usually.
C++ has all the C problems, and multiples more on top of those. It's a broad attack surface - literally no one is going to claim to be proficient in every single C++ feature available to their compiler. It's also quite opaque to visual inspection (making double-checking with an LLM difficult as it needs whole-program reasoning instead of localised reasoning).
One of those languages is one of the most complex programming languages ever invented, with the largest breadth of features, any of which may interact with any other feature in subtle ways.
The other is one of the most minimalistic languages created, with a dev able to keep the language standard in their head for the most part.
RAII definitely removes whole classes of errors.