Thursday, July 24, 2008

Does Security Make C++ Obsolete

Stephen Gould said every species is extinct, they just do not know it.

From a security point of view C++ may be obsolete and we just do not know it yet. Increasing C++ is justified based on performance factors and legacy code. The performance increase that still remains is due primarily to the direct access to memory. This is when comparing to a language that handles memory management like Java or C# or VB.Net.

The security implications of direct memory access becomes apparent when examining lists of top security threats. At the top of the list are Buffer Overflows and Stack Overflows. Both are possible only because of direct memory access.

Since C# is memory managed except when you explicitly tell it not to be, you could say that it is "Secure By Default". This is in contrast to C++ which is "Unsecure By Default."

No comments: