HACKER Q&A
📣 tomcam

C programmers, aren't the footguns obvious, or am I missing something?


Dipping my toe into C after a quarter century when I was a full-time C/C++ programmer. Am slightly unnerved by articles like the Git list of banned C functions [0] because... I don't know what the ruckus is?

Even back in the day, I regarded unsafe functions such as strcpy() as nothing more than courtesies by the stdlib providers. I assumed it was up to me to write my own libraries for strings, linked lists, concurrency and so on precisely because they weren't reentrant or memory-safe.

Fast forward to today. Has anything changed? If I decide to use C89 or C11 for a project, aren't I still responsible for my own string allocation/comparison duties, etc.? Aren't I just going to roll my own string structure type with its own size_t length value along with a terminating 0 byte for compat and invent or find a Unicode library?

In other words, are all these complaints people have just nature of C, or is there something about C development that's changed fundamentally in the last couple of decades?

[0]: https://github.com/git/git/blob/master/banned.h


  👤 softwaredoug Accepted Answer ✓
I think the amount of work you describe to create a string library is nontrivial and easy to make a security mistake.

If I have to do that work I begin to ask “do I _really_ want to work in this environment where I have to maintain this kinda stuff?”


👤 greenyoda
See also the main discussion about git's banned.h: https://news.ycombinator.com/item?id=26347867

👤 ojnabieoot
I think this might be the part from banned.h that you’re missing:

> (and even if used correctly complicate audits).

With correctness-sensitive and security-sensitive C programs like Git, it is not enough to simply assume flawless diligence and care on the part of the developers (especially since the unsafe functions are very convenient and can easily slip in to production code during testing or prototyping).

So “banned.h” is really an automated auditing tool: at a quick glance, Git users can verify that large families of C bugs are much less likely throughout the Git codebase (and many standard strlen/etc bugs are obviously impossible).