&quot;I really don&#x27;t see how it is. If you&#x27;re running on a desktop platform, you&#x27;ve got a huge exposed surface that is working with raw pointers to proprietary logic. That makes provable correctness a far, far more complex problem.&quot;<p>The point is that C++ itself is damn-near impossible to analyze on the cheap and without much false positives. That&#x27;s before I even considered the C interface. Then there&#x27;s C level problems that have been the reason I&#x27;ve opposed it forever. At least there&#x27;s tons of stuff to draw on in analysing, transforming, etc that code. I&#x27;d go with a C subset or Java&#x2F;Ada subset with high-integrity runtime any day over C++.<p>&quot;It is easy to implement a smart pointer that the compiler can prove will always do bounds checking before dereferencing. The hard part is proving that all the code that uses raw pointers is doing the same thing.&quot;<p>I&#x27;ll take your word on the smart pointers doing bounds-checks as I&#x27;m not up-to-date on all the techniques of C++ developers. Academics need to do a fresh take on that with assessments vs particular risks &amp; compared to current languages. Meanwhile, most in safety-critical development that I know of don&#x27;t use C++ because it&#x27;s too complex and unsafe per them. I know there&#x27;s MISRA subset and some other stuff. There are people who use it with thorough testing and source-to-object validation. Mostly not in use, though.<p>So, do you have any resources showing that C++ code is safe and analysable if one just uses smart pointers? And what tools and subset you use to do that? If you have that and proof it works, then that could help a lot of developers using C that aren&#x27;t aware of it. I&#x27;m being serious as much as I am challenging your claim. If you have it, I&#x27;ll consider it.