OK how is this on the homepage? The title means nothing without clicking the link and... I generally refuse to click on clickbait just to see whether there's a hook in it.
'the only language where 90% of the world's memory safety vulnerabilities have occurred in the last 50 years'
Let's assume this is true, and ignoring the fact that it's not possible for more than 1 language to have >50% of the vulnerabilities, we are left pondering what proportion of the worlds software is written in C. If it's >90%, then C is safer than average :)
Assuming that C is the most successful language of its generation, among those letting purposely do anything with memory access, well, it's unfortunately possible to have it do anything. It's like saying with surprise that a harpoon gun may even kill people.
Then successively implemented languages may have improved things (or they would have been useless efforts). When a single one of them will reach half the popularity of C (without running in any "unsafe" mode) it will be another great success.
The original article was clearly just a polemical overkill by a maniac of another language. Or by a fisherman who kills fishes slapping them.
The critique is more that the average, or at least loud, C programmer is resistant to fixing these problems (for example via Rust) and often arrogantly claim it's just a skill issue.
The argument sometimes comes off like: "Why aren't you better at juggling double-edged swords that are on fire?" Perhaps the opposite side might say: "Why can't we juggle inertia-powered lighted yo-yos instead?"
10 comments
[ 0.21 ms ] story [ 7.8 ms ] threadLet's assume this is true, and ignoring the fact that it's not possible for more than 1 language to have >50% of the vulnerabilities, we are left pondering what proportion of the worlds software is written in C. If it's >90%, then C is safer than average :)
Then successively implemented languages may have improved things (or they would have been useless efforts). When a single one of them will reach half the popularity of C (without running in any "unsafe" mode) it will be another great success.
The original article was clearly just a polemical overkill by a maniac of another language. Or by a fisherman who kills fishes slapping them.
https://nvd.nist.gov/vuln/detail/cve-2023-53161
https://nvd.nist.gov/vuln/detail/cve-2023-53161
https://www.sentinelone.com/vulnerability-database/cve-2026-...
https://nvd.nist.gov/vuln/detail/cve-2026-71560
https://www.invicti.com/web-application-vulnerabilities/pyth...
This article is about the frequency of these bugs, not their existence. C and C++ are the only languages where this happens regularly
I don't think the average C dev isn't aware that the language has pitfalls, especially around memory management.
Also a lot of these problems are because C is used everywhere and has been for so long. Not because people are blind to it's problems.