Last Friday, banks, airports, TV stations, healthcare organizations, hotels, and numerous other businesses experienced widespread IT outages, grounding flights and causing extensive disruption as Windows machines encountered errors worldwide. And we wrote a post explaining that soon they would blame C++ for that, and that is exactly what is happening, as we can see here.
One of the main reasons we encounter serious issues involving C++ is that, because of its power, it is widely used in critical systems. In these critical systems, even a single bug can lead to a disaster.
Suppose all critical systems were developed in Java or C#. Would those systems necessarily be safe? The answer, as Herb Sutter explained in this detailed post, is no.
But there have been misconceptions, too, including focusing too narrowly on programming language safety as our industry’s primary security and safety problem — it isn’t. Many of the most damaging recent security breaches happened to code written in MSLs (e.g., Log4j) or had nothing to do with programming languages (e.g., Kubernetes Secrets stored on public GitHub repos).
As Herb Sutter pointed out, most of the top 10 most dangerous software weaknesses of 2023 were not related to memory safety.
Most of 2023’s top 10 “most dangerous software weaknesses” were not related to memory safety. Many of 2023’s largest data breaches and other cyberattacks and cybercrime had nothing to do with programming languages at all.
Blaming C++ for the prevalence of software bugs is a simplistic view that overlooks the broader context of software development. While C++ offers a high degree of control and performance, it requires careful and skilled usage to avoid pitfalls. The same can be said of any programming language, each of which has its own set of challenges and potential issues.
Ultimately, the responsibility for software quality lies with developers, testers, and the development process itself. Emphasizing proper education, rigorous testing, and adherence to best practices can mitigate many of the risks associated with any programming language, including C++. Rather than vilifying a tool, we should focus on improving how we use it to create reliable, secure, and efficient software.