Comment Comment by gw2 What is your opinion on deploying C++ codebases with mitigations like CFI and bounds checking?Let us say I have a large C++ codebase which I am unwilling to rewrite in Rust. But I:* Enable STL bounds checking using appropriate flags (like `-DGLIBCXX_ASSERTIONS`).* Enable mitigations like CFI and shadow stacks.How much less safe is "C++ w/ mitigations" than Rust? How much of the "70% CVE" statistic is relevant to my codebase? parent gw2 1 year ago
Let us say I have a large C++ codebase which I am unwilling to rewrite in Rust. But I:
* Enable STL bounds checking using appropriate flags (like `-DGLIBCXX_ASSERTIONS`).
* Enable mitigations like CFI and shadow stacks.
How much less safe is "C++ w/ mitigations" than Rust? How much of the "70% CVE" statistic is relevant to my codebase?