Will code-check tools make for worm-proof software?

TalkBack 26 of 37:

Next »

« Previous

• Thread View
• Flat View

Yes, but not for the reasons you might think....

It helps to remember that "C/C++" was a marketing term coined by Microsoft for their C 7.0 compiler (early '90s). When the competition, notably Borland, Symantec and Watcom, were producing superior compilers that accepted reasonably standardized (pre-ANSI) C++ code, Microsoft was still stuck with a C engine with defects that had been well-known since the mid-80s. "Advanced" features like exceptions, run-time type information, templates and so on were not available with "C/C++" 7.0 and Visual "C++" 1.0, not because they were "too advanced" for users - who were screaming for them - but because Microsoft was institutionally incapable of keeping up with the compoetition, let alone innovating. (See Steve McConnell's books, notably Code Complete, for a more inside-the-greenway viewpoint). It took years - until the introduction of "Visual C++ 6.0" (C compiler version 12.0) for Microsoft to deliver a tool that experienced C++ developers could take seriously.

What does this have to do with code stability and quality? Everything. Since Microsoft bludgeoned themselves into a dominant position in compilers (owning the development and target platforms didn't hurt) without actually having to deliver the "advanced" features that really made C++ C++, their consumers (programmers in the field) didn't actually have to use the language features that would have made their code more reliable. By using "Visual C++" as "minimal C++ semantics and traditional C coding styles", from a stability and security standpoint, we're back in the K&R C days - but we've psyched ourselves into thinking that our code is so much better because we've got all these nifty tools available. But it really isn't, since we haven't made the change in mindset needed to use the tools effectively. It takes about a year for a good C programmer to become a decent C++ programmer under optimal conditions. The hardest part is learning to think differently - to approach program architecture and implementation from a different viewpoint. Once you do that, however - and once you have the tools and other kit needed to do an effective job at that - the programs you write will be inherently more secure.

That, in my view, is the main thing that's needed if we want to have secure, trustable software. Developers need to really make that transition - and customers need to encourage companies that do that and penalize the ones that obviously don't do it in a systematic way.

Posted by: jdickey_z   Posted on: 05/27/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• SOA for Dummies 2nd IBM Limited Edition Mini eBook IBM Learn the basics of SOA by following 7 real-life companies as they experience the truly game-changing effects of this important technology initiative. Download Now
• Reducing Server Total Cost of Ownership with VMware Virtualization Software VMware VMware virtualization enables customers to reduce their server TCO and ... Download Now
• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now