Addendum to “Curl is C”
Note: I am discussing using safe languages in general and reasoning for doing or not doing that. If you believe rewrite requests are unreasonable no matter what,
don&#x27;t bother reading that. Or perhaps consider this to be addressed to people deciding how to choose libraries to depend on, not to specific library authors.<p>&gt; curl is currently one of the most distributed and most widely used software components in the universe, be it open or proprietary and there are easily way over three billion instances of it running in appliances, servers, computers and devices across the globe. Right now. In your phone. In your car. In your TV. In your computer.<p>Congratulations. So how many of those have unpatched vulnerabilities right now that were caused by using unsafe language? In my phone? In my computer? In my car? How many accidents of data or money theft it caused? Not to mention common non-security related bugs.<p>&gt; If we then have had 40, 50 or even 60 security problems because of us using C, through-out our 19 years of history, it really isn’t a whole lot given the scale and time we’re talking about here.<p>Curl had multiple unpatched security problems for several years before they were discovered. As the author admits, it most likely still has many.
dpkg -l | grep &#x27;^ii  lib&#x27;|wc -l lists over 2000 libraries I have installed, lot of them written in C. An estimate of 2000 multiplied by 60 is ... scarily to many. Large amount of them avoidable by using safer languages.<p>&gt; Using another language would’ve caused at least some problems due to that language<p>If it solves more problems than it creates, it is worth doing.<p>&gt; none of the memory safe languages anyone would suggest we should switch to have been around for 19 years.<p>Neither have been mobile phones (at least as we know them), but they are useful, so I am using one.<p>&gt; We will continue to work hard on minimizing risks, detecting problems early by ourselves and work closely together with everyone who reports suspected problems to us.<p>I prefer to work smart, not hard.