I'll get back to you when my work projects are allowed to use a C++ version newer than C++11. </rant>
But, more seriously: I'm curious if so few people are actually using C++20 (for work, at least) that it will take a while to answer questions like yours.
It is the same problem as with C, Java and Python.
In many business, many coders learn just enough to get the job done and never care about moving forward with their knowledge unless obliged to do so.
When doing contracting where one gets to jump into random codebases just for a couple of months, it is quite sadding the quality of code that we routinely find out.
The many book examples would be exploitable under the traditional attack vectors nowadays in practice, or would generate tons of red lights when put under a static analyser, yet that is how many still program in C.
Bare bones strcpy() and memcpy(), pointer arithmetic all over the place without helper functions to validate application invariants, #ifdef spaghetti code, not using translation units as poor man's modules,...
Comments
I'll get back to you when my work projects are allowed to use a C++ version newer than C++11. </rant>
But, more seriously: I'm curious if so few people are actually using C++20 (for work, at least) that it will take a while to answer questions like yours.
It is the same problem as with C, Java and Python.
In many business, many coders learn just enough to get the job done and never care about moving forward with their knowledge unless obliged to do so.
When doing contracting where one gets to jump into random codebases just for a couple of months, it is quite sadding the quality of code that we routinely find out.
It is like playing Mikado with code.
This is not really a problem in C, since there's little beyond the "just enough". But agreed about other languages.
With C++ you're basically always at a point where you only know a little, even if you've worked on your C++ skills for years... :-P
It is because it means many code against the security considerations of K&R C.
I'm not sure I understand what you mean. Can you give a concrete example?
The many book examples would be exploitable under the traditional attack vectors nowadays in practice, or would generate tons of red lights when put under a static analyser, yet that is how many still program in C.
Bare bones strcpy() and memcpy(), pointer arithmetic all over the place without helper functions to validate application invariants, #ifdef spaghetti code, not using translation units as poor man's modules,...