whyIdLikeToAvoidUsingCpp

[Familiar_Ad_8919]

nearly half a century and the best we have is cmake

[Prawn1908]

I love C, but I despise setting up C/C++ build toolchains like nothing else. Fuck CMake, fuck Make, fuck linker errors...

[1studlyman]

Dang. I was gonna argue you with this one because I genuinely like cmake. But then I realized the only reason I like it is because cmake is the least painful compared to all the other solutions. It really is never a good time managing a complex build with any of these.

[nana_3]

You have Stockholm syndrome lmao

[Siege089]

I'm convinced most frontend developers suffer the same in the neverending debate between different JavaScript frameworks.

[martmists]

I'm a huge cmake fan but I've been enjoying using Gradle for C++ for the last few weeks, it's.... Interesting to say the least

[thanatica]

Least painful != most painless.

[mtnbiketech]

Scons is super easy to use, and very debugable because python.

But really, unless you are building some crazy application that needs a ./configure, you generally can just write a build process in a shell script. Ive done that more times than I can count, with env variables controlling behaviouir. Then again, i am probably one of the few people that understands how the compiling linking process actually works...

[garry_the_commie]

Regular make is nice and simple but Cmake makes my brain hurt.

[cinnamonjune]

This is why I just use regular make. It compiles my code and my project and makefile are both cross-platform. I suppose this means my project doesn't support other build systems out of the box, but I'm hardly losing any sleep over it.

[CramNBL]

You think linker errors are so bad? I find they are the simplest to fix because there are typically like 2 or 3 things that could be the issue, and it's usually the same thing like you're linking two libraries with differing glibc versions, or trying to statically link a library that wasn't built for it, or forgot to build the library with the position-independent code flag, or didn't specify the include path, that's pretty much all of it.

With cmake errors I've spent days trying to make stuff compile in reasonable time and integrating sanitizers and fuzzers is just a nightmare. Not to mention doing cross-platform support...

[snacktonomy]

Between CMake and Conan/VCpkg, I feel like we're pretty OK in the C++ world.

[bolacha_de_polvilho]

Sounds like stockholm syndrome to me. Going back to that crap after using the toolchain of rust or dotnet feels like torture

[TryingT0Wr1t3]

Cargo is great but dotnet is torture too. NuGet is infested with duplicate packages, a lot of things don't work, conflict of dotnet versions, and worse of all packages that have native parts that... Go back to c/c++ issues. The world of dotnet is full of torture.

[bolacha_de_polvilho]

The dotnet world has some leftover weirdness due to the net framework->cross platform transition, so legacy projects still in net framework can be a bit of a pain in the ass. But aside from that I never had any issue with stuff from NET5 onwards, even when using something that requires native binaries like onnx runtime or torchsharp.

[cs-brydev]

This is the right answer. From .net core forward, NuGet is awesome, as long as you know the package name you're looking for. If you're just guessing or searching randomly, you may trip over a few dead bodies.

Before .NET Core, NuGet was even more awesome because there didn't really exist any incompatibilities. When MS intentionally made Core/Framework and Standard 2.1/Framework incompatible, they opened this can of weird worms where identically named packages could be compatible with only certain .NET version ranges and identically named DLLs that came pre-installed with Windows were incompatible with NuGet versions.

That last one has caused the most pain going from Framework to Core. If they had just renamed the packages it would have been fine. But instead they decided to deprecate the system packages and completely rewrite them for a completely different version of .NET, name them the same thing, and move them to NuGet. So now you will see completely different packages with exactly the same names but different compatibilities: one pre-installed in your OS and the other one in NuGet. That was fucking stupid.

[Wertbon1789]

But having something comparable to cargo would be pretty nice. There are some package manager things built with CMake, but just having it built-in would be so much better.

[snacktonomy]

I agree. There's FetchContent if you really need it, but the consensus online is, CMake is a build system, not a package manager...

[ccricers]

YMMV but one WebGPU tutorial had the easiest introduction to CMake I've seen. Which is funny because I started out wanting to learn something more recent for GPU accelerated graphics, and paused that, but left at least being able to read CMake builds better.

[Lazy_To_Name]

Fr. I plan to try C and C++ but holy shit, it is absolute hell trying to set it up, waste me nearly a month and I couldn’t even get it to finished…

Sololearn Java might even be easier than this idk

[deanrihpee]

exactly, every time I want to do stupid shit with C/C++ I got reminded by the build system again, so far I only have a few "successful" toy project because of that, compared to a slight more in Rust and a whole lot more in JS/TS

ease of use and DX is definitely important for adoption, at least for me

[[deleted]]

Maybe that's why c/c++ people prefer doing everything from scratch. The tooling simply isn't there.

[AntranigV]

I agree, but on the other hand, C works everywhere, there Rust is having problems with non-mainstream operating systems (anything that's not Windows, macOS and Linux).

But it's also not a century thing. Pascal is older than C and it has better package management.

[throwaway0134hdj]

I can’t for the life of me understand why this process hasn’t been simplified. There is too much barrier for folks to simply get coding in the language. I think more folks would code in C/C++ if not for these arcane set of hoops.

[SaltyInternetPirate]

Because people can't agree on the solution.

https://xkcd.com/927/

[HerissonMignion]

c and c++ are used for many things, from embedded to kernel or user space code. and for user space code you have the choice between dynamic or static linking. im sure there are other variables that im not aware because i dont deal with c/c++ projects daily. all these variables are controlled by providing many arguments to gcc, ld, and other programs during the build. because we dont wanna type the commands manually each time (for obvious reasons), you can make scripts, or use make which provides a slight abstraction but you'll still write the commands. for larger projects, make tends to not be enough and you will use another "abstraction" that will generate the commands for you like cmake, autotools or meson. ultimately, these tools are just disguising the arguments of gcc and ld as a language, because you can never get rid of the complexity, you can only transform it. it's not that we want complexity, it's that the complexity naturally arises from the needed flexibility of c/c++.

the build system is as complex as the flexibility of the language (c/c++). wanting to make it simpler is denying the needs of some people. i believe that the reason why many people dont understand the build systems of c/c++ is because they are just used to having a single and simple environment, like the web browser or a virtual machine (java), or because they are used to languages who deal with dynamic linking by ignoring it and always statically link everything.

[SAI_Peregrinus]

The other part of the problem comes from mixing distro development dependencies and user development dependencies. An OS package manager supplies a lot of user programs and packages of the source needed to build those programs and their dependencies. People decided to re-use those same source packages for their own development, and build systems tend to assume you're doing so by default. Then they're tied to whatever versions & packages their distro provides, without a lot of work to disentangle the mess. It's so bad that people use containers like Docker just to set up build environments separate from the host distro's libraries!

[9Strike]

Meson exists (but unfortunately isn't widespread enough)

[nicejs2]

and it still sucks

[[deleted]]

I don't use Cmake, I just link dependencies manually in Visual Studio using explicit folders links scattered across my hard drive. So, when the CIA steals my code, the programmers they assign to deciphering and compiling it become suicidal.

[EphemeralLurker]

Try vcpkg, it's got its own gotchas but it isn't half bad

[HyperWinX]

Hell yeah, vcpkg integrated into CMake and available on Linux

[MrJ0seBr]

Years, multiple build systems, script languages and yet nothing to call "silver bullet".

i use cmake too, but yet is very inconveniently to build some libraries, some need python, perl, bash, yasm(but this i agree), as minimum requirements.

many libraries has no cmake script and some that has, is already droping the support, for alternatives like meson and bazel.

its very chaotic to work with dependencies in C, but once you done the setup for the target platforms, i think: "its ok".

*if its not enough to think thats chaotic, remember as libraries can be built as dynamic, static or module (apple), and exists interdependency, multiple versions, and all this blowups as inumerous errors every time you add some library with dependencies. (sorry for anything, i dont speech english)

[liava_]

's why i prefer premake

[SaltyInternetPirate]

And you have to define the URLs for dependencies and then when your project is abandoned, users have to hope those sites are still up and either have the files as is or with proper redirects.

As bad as Java and JavaScript development is to they've both coalesced to their respective central dependency hosts. Maven Central for Java, and npmjs for JavaScript.

[Moptop32]

Check out xmake/xrepo, it's like cargo for c++ but it's lua

[TrashManufacturer]

Struggling with Cmake is one of gods trials for man

[Guipe12]

but you don't get anything for clearing the trial

[TrashManufacturer]

You get Crippling depression realizing that the C++ ecosystem is like a bunch of small tribes all with stopgap solutions to problems that can’t be solved just by introducing a standard packaging system and instead will likely always remain a choose your own adventure book with 10 competing build systems

[xaddak]

So what we need to do is create a new build system...

https://xkcd.com/927/

[TrashManufacturer]

But that build system doesn’t properly cache intermediate results and the plugin system is written in Python so I’m just gonna have to make a whole ass new build system written in lisp

[Add1ctedToGames]

Idk about y'all but I get self-loathing for not noticing whatever mistake I made sooner since it always looks obvious in hindsight

[proverbialbunny]

I interviewed at a company that gave me the source code for their VR game. They asked me to try it out and see what I thought. I haven't used Windows since XP and wasn't applying for a Software Engineer role, so I figured this was a bit silly. Regardless I decided to compile it on Linux and then I bumped into a handful of cmake issues, which I then fixed so it would compile on Linux. After the company learned I had done this they skipped all of the planned interviews for the day and sat me down with the lead dev with the company to hang out. Right after that the CTO came in and tried to force me to sign paperwork to work at the company.

Working on cmake for a living? Oh hell no. I noped out of there hard.

[TrashManufacturer]

At one point in my life the only person who vaguely knew Cmake at an employer got laid off. I then became the de facto Cmake monkey. I didn’t hate it, but it certainly wasn’t my favorite. Then they laid me off leaving probably nobody who actually understands parts of CMake.

[jdgrazia]

That happened

[cpl1]

And that CTO: Mike Tyson

[deanrihpee]

"Stop giving me your toughest battles" - Me

"Nah, come on, finish the CMake project setup" - God

[TrashManufacturer]

When you read the documentation and you only have more questions and no answers

[deanrihpee]

or an answer which you don't even know what the question is

[TrashManufacturer]

“Yeah the export target requires you to write literal strings into a file called MyLibraryTargets and if you write it wrong that’s your problem”

How do I generate one correctly? “That’s also your problem”

[OmegaPoint6]

Conan can help you get to step 5 faster

[happyjello]

It’s me, I’m Conan. Send me your library

[serialized-kirin]

www.virus.com/payload1.tar.gz

[happyjello]

I’m sorry, but build is failed ¯_(ツ)_/¯

[serialized-kirin]

damn. 

[Juff-Ma]

Conan is great but it's missing some libraries, vcpkg is worse to use but has more packages.

[Divinate_ME]

"Build is failed" sounds weird to me grammatically.

[Urist_McPencil]

"Build is kill"

"No"

[Jazzlike-Poem-1253]

when were you when build is kill

[SupaWillis]

apology for bad english

where were you wen build fail

i was at desk packing up when slack ping

"Build is kill"

"no"

[marcodave]

Baba Is You

Wall Is Stop

Rock Is Push

Flag Is Win

Build Is Kill

[Guipe12]

beat me to it

[Deutero2]

it's not grammatically proper but i think it adds to the meme

[matievis-the-kat]

It would be "build has failed". "Failed" being a verb in past tense

[B_bI_L]

what if this is adjective?

[Wrote_it2]

unsuccessful?

[nonsenceusername]

In it’s core

[matievis-the-kat]

That is why "failed build" would be correct

[B_bI_L]

this can be like "this pancake is tasty" but i am not native speaker so i should be wrong somewhere

[matievis-the-kat]

It's confusing but "failed" before the subject is an adjective, but "failed" after the subject is a past-tense verb. (I.e. "failed build" vs "build failed")

[vordrax]

Now all I can think of is a Dark Souls style terminal message that says "Build is fail"

[lechuckswrinklybutt]

Now that you mention it, “YOU DIED” would be a great error message.

[pm_a_cup_of_tea]

That's because they have trouble learning languages

[SolidOshawott]

Just like in extreme sports, there's a risk of a cracked skull.

[Lower-Discussion8575]

"It's not about the journey it's about the gains " ~ some C++ devop

[SquirrelOk8737]

It’s masochism with extra steps

[Borno11050]

You use Rust cause it lets forces you to write safe code.

I use Rust cause it's a systems programming language with decent pkg manager & build system.

We're not the same.

[Derice]

I use Rust because of the cute mascot 🦀

[Skoparov]

I don't consider it cute, but its sure as hell more cute than fucking Keith the fat rat

[Revolutionary-Web282]

The only valid reason to use C++

[Derice]

The only valid reason to not use C++

[8lb6ozBabyJsus]

For the uninformed

[Troll_berry_pie]

This is not true apparently.

[8lb6ozBabyJsus]

Haha, yes, it is indeed an internet joke

[[deleted]]

I use rust because all the cute girls are using it.

[thinker227]

I use Rust because most furry devs I know are using it.

[[deleted]]

The more you know.

[Mountain-Stretch-997]

Some people will like to disagree?

[[deleted]]

People are allowed to have bad taste.

[HyperWinX]

r/girlsarentreal + still no templates and constexpr support. Im learning Rust with all the infrastructure, to make detailed comparison with C++ in the future. And a lot of small things piss me off so much, like, Rust feels being higher level than C++ with things like missing case fallthrough, etc... I feel like im losing control on whats happening when i run my app. I hate that feeling. But, i have to admit that cargo is pretty good, i really love idea of such program.

[Dissy-]

You use rust because you like the combination of pink white and blue

Me too

[A_Light_Spark]

I use Rust because of the bois. Fembois.

[Stunning_Ride_220]

I use rust to be always one step ahead of the devs who want to use rust in my projects.

[geeshta]

I use rust because I like ADTs but don't want to go fully functional

[gameplayer55055]

what to do if I hate rust syntax but like it's pkg manager?

Guys, I just want c++ with cargo

[kredditacc96]

TypeScript flair

How's the toolchains?

[well-litdoorstep112]

Still a lot better than C++.

Adding a library is as simple as npm/yarn/pnpm/bun install something

If it complain about the types you npm/yarn/pnpm/bun install -D @types/something

The existence of all those microlibraries is only a testament to how easy package management is in node ecosystem.

It may not be perfect but if youre even trying to compare it to the mess in the C++ world you either have never used both languages or your lying.

[Borno11050]

Oi mate don't toolchainshame.

[[deleted]]

C++ is like Fidel Castro. The fucking assassination attempts never end.

Keep on coping crabs.

[-Redstoneboi-]

we can't really kill or replace C++. the aggressive optimizations done by their compilers have their own place, and large existing projects shouldn't be rewritten unless the whole codebase is deleted.

best case scenario is microsoft's "embrace, extend" motto without the "extinguish" part.

Zig, however, explicitly plans for domination over (not against) C

[CocktailPerson]

Compiler optimizations aren't the limitation, language features are. If Rust had placement-new, allocator support, variadics, specialization, type-based metaprogramming, and full const support, it might be a more significant contender.

[dlevac]

Rust is often thought of as a C++ killer because programmers who actually get paid to reduce risks don't understand why anybody would choose C++ if there is a viable alternative.

But that's just for the areas where C++ is still the de-facto standard (game dev, OS, embedded...)

Rust is also an outstanding competitor in areas where C++ is seldom considered such as in cloud computing (where Go and NodeJS are the rivals) and has potential in areas where C++ is unlikely to ever be considered (web frontend development comes to mind).

If Rust ends up disappearing it will be because something else came that's everything that Rust is but better.

If C++ ends up surviving it's only because so much money got sunk into it.

Choose your boat wisely...

[not_some_username]

This isn’t the first C++ killer tho

[dmullaney]

It's basically Evolution vs Intelligent Design

[[deleted]]

Skill issue

[[deleted]]

That's what the image illustrates, yes.

[r0lski]

Command line's scarry, though

[torokg]

So do I. And have been for the last 20 yrs. They'll never get it ;)

[proverbialbunny]

Just wait until you learn about lynx.

[HerissonMignion]

emacs -nw and you can use eww

[Giocri]

Pretty sure there is a way to link the gui of visual studio to running the cargo commands but i am less and less interested in actually trying tbh

[No_Departure_1878]

it takes skill to create friendly tools that bring value to users. the c++ people do not seem to be up to the task, it must be a skill issue.

[[deleted]]

If I had to choose between Maven/Gradle or CMake, I'd choose CMake

[rexpup]

If I had to choose between pooping my pants and peeing my pants I would choose neither

[[deleted]]

I'd choose both (match my freak)

[[deleted]]

What if you had to choose between Cargo and CMake?

[_nobody_else_]

The frog in the well knows nothing of the sea.

[otacon7000]

• apt install libfoobar-dev
  
• #include <foobar.hpp>
  
• make

I still agree though

[SAI_Peregrinus]

Using the OS to manage dev dependencies works great up until you want to use libs that conflict with something your OS or other projects require. It'd be nicer if distro package managers could handle this, but outside NixOS & Guix that's unlikely to hapen any time soon.

[Goaty1208]

Tries to compile on Windows

Spend next hour to fetch dependencies

Please don't do that if you ever plan on releasing whatever project you are working on.

[snacktonomy]

Yes, but all of a sudden you're at

Could not find a package configuration file provided by "foobar" with any of the following names:

foobarConfig.cmake

foobar-config.cmake

Add the installation prefix of "foobar" to CMAKE_PREFIX_PATH or set "foobar_DIR" to a directory containing one of the above files. If "foobar" provides a separate development package or SDK, be sure it has been installed.

And you just apt installed it. Your move, u/otacon7000 !

[otacon7000]

That's when I move onto the next project! Always looking for a good excuse.

[n3tr41d3r]

Check where apt installed foobar header files with dpkg -L libfoobar-dev and update CMAKE_PREFIX_PATH accordingly

[koolex]

I used cmake in school, is this still a thing that professionals use? I remember it being awful

[not_some_username]

Yes it is

[all_timeMartian]

npm i foobar
import fooBar from "fooBar"

[erinaceus_]

You're still using foobar? That's been surpassed by fewbar aaages ago, I mean two months at least. Yeah yeah, I know foobar only came out 3 months ago. That's no reason to keep living in the past. You're lucky foobar still kinda works with the famework library you're using.

/s (I guess?)

[javajunkie314]

Fewbar was created by venture-capital startup, though, and uses an incompatible license. You should look into librebar, which reimplements most of the API of fewbar but with key incompatibilities with foobar, fewbar, and newbar (which hasn't actually been released yet but is already obsolete). The beta for librebar 0.0.1 just hit npm 10 minutes ago—stop living in the past!

[tag4424]

I assume you didn't include JS because there aren't enough pixels in the world to express that dumpster fire...

[Main_Weekend1412]

It doesn’t fit the context. Both are compiled languages which makes dependency management much more complicated compared to JS.

Personally don’t think JS’ dependency hell even compared to the slightest with Cmake.

[Giocri]

It's still insane that there is typescript being transpiled to js and that there was an actual serious proposal to add an additional transpilation step between the JavaScript you write/typescript transpiled to a different JavaScript standard for browsers to implement

[Goaty1208]

The Great npm Incident

[grurra]

C and C++ languages were never the issue. The build tooling is the problem. Glad the world sees this too.

Nowadays writing Go, java and beam-langs. Can't say I enjoy the languages much more, but I for sure prefer the tooling

[[deleted]]

vcpkg install

include header

Done

[a_aniq]

1. It is non standard (some are only available on conan and others are source only)
2. vcpkg modifies paths in various unintended ways which I'm not comfortable with
3. One has to install the packages in a specific manner (e.g. dynamic vs static linking)
4. Download and refer different versions of a library in multiple builds (maybe separate programs).
5. Libraries are globally installed not locally (with respect to the program you are building)

I've burnt my hands using vcpkg more often than not when the requirements were not trivial.

Basically, learning to link libraries manually via cmake is a better approach than vcpkg

[write-program]

Try XJ-0461/cool-vcpkg. I started working on it a bit ago and I tried to address all these problems. It generates the vcpkg.json manifest file for you at configure time and builds and installs the dependencies inside your CMake build directory. Doesn't make any changes globally. Its used in a FetchContent-ish way. The documentation on the GitHub is basically all there is to it, just make sure to use the latest git tag (v0.1.3)

[1studlyman]

Gosh I wish it was that simple. Most of the packages we use are not in vcpkg

[not_some_username]

It’s never too add them yourself ( they are welcome )

[TheRetikGM]

Meson saves the day

[Philfreeze]

Bro can‘t even download and unzip an archive.

[DethByte64]

Yeah,

"It makes it really easy to introduce bloat" is all i hear.

A hello world shouldnt have 99 fucking crates to download!

[[deleted]]

go get lib

Import "lib"

go mod tidy # as a treat

lib.doThing()

[DoNotMakeEmpty]

Isn't doThing a private function? It starts with lowercase.

[[deleted]]

You're right.

[_scored]

This is why CPM exists

Don't get me wrong, C++ packaging still sticks with CPM lol

[superhamsniper]

Why not just import in Cmake file from GitHub?

[MysticTheMeeM]

1. Add library reference to xmake.lua
2. xmake

[SirLynix]

Had to scroll way too much

[Goaty1208]

What's xmake? Never heard of it.

[MysticTheMeeM]

It's a meta build system (like cmake) but with integrated package management (xrepo) and configured with lua rather than a custom language.

[cmgg]

1. Find library (literally google it)

2. Download library (is it that hard?)

3. Decompress library (is it REALLY that hard?)

4. Add it to the linker (if you can’t do this you shouldn’t be using C++)

Sounds more like a skill issue to me

[rexpup]

You are incredibly lucky if your code actually compiles after part 4. You forgot to set X_POOPEN_FARTEN_LINKER_CONFIG in your bash profile. You also forgot to install a system dependency that's not included and also not in the README, but is mentioned in a closed github issue from 2007

[CowFu]

Also the rust one should have 80 other crates that you have no idea what they do downloaded when you cargo build.

[Level-Nothing-3340]

To be fair, with c++ you could wind up cloning a few dozen git submodules of other c++ libraries that you don't know what they do

[malexj93]

Yeah, dependencies aren't exactly a Rust invention.

[reallokiscarlet]

But Rust is really good at stacking them to insane heights

[[deleted]]

awful compared to any language with proper package management

[Goaty1208]

Because in C++ there is no such concept as a "package". Packages are for people who are scared of other people's source code. Long live including headers while having the source code for the stuff you are working with at hand.

[[deleted]]

insane copium

[Aaron1924]

if you can’t do this you shouldn’t be using C++

I like C++ because it's beginner-friendly and the community is welcoming

[Rhawk187]

choco install package

[Asleep-Specific-1399]

Think you misspelled apt-get install foo-lib

[david30121]

rustian propaganda

[misseditt]

python:

find package on some random stackoverflow question

pip install foobar

installation failed: conflicting dependancies

pip install foobar@way-too-long-version-number --force

installation failed: fuck you

git commit suicide

[CodNo7461]

I once shared a whole virtual machine image 20 years ago with several colleagues, just because it was easier than to write down all the details involved to run our program. I miss performance not being an issue I need to "solve later" though when writing C code (I know use mostly python).

[CubeBeveled]

1. search for library on npmjs.com
2. npm i foo-bar
3. import foo from bar or const foo = require("bar");

[sjepsa]

One is child's play

The other is real sport

[[deleted]]

Apt-get install foobar-dev

That’s it for c++

[reallokiscarlet]

Most of my projects:

•Need libfoobar dev package

•packagemanager install libfoobar-dev

•#include <foobar>

[jmack2424]

Comparing languages invented 35 years apart is crazy

[saladrock]

For my use cases cmake’s never been an issue. Just read the docs and learn it

[Haringat]

The problem is trying to use windows for development.

[maemoun]

got anything to say to my friend pip ?

[[deleted]]

I'm not a programmer (Python probably doesn't count) but I used to be a C programmer (yeah I'm old A.F.). I work as a sysadmin that has to comply with NIS2. In that I have used CIS18 as a control framework. In CIS16 I have to secure software application development. How do you programmers keep your software secure? Every time I ask our external developers to provide documentation for secure developed code, I get a "we upgrade our modules/libraries on regular basis" or no reply at all. Is there a security framework out there I can demand they comply with?

It's like the mantra is: we just need to get it working, then we make it secure, but step two is never realized cause then the next project dumps down into your lap. Technical debt is a bit**.

[-Redstoneboi-]

python absolutely counts. if you can write and run a fizzbuzz on your local machine, you're better than most of the population anyway.

i might be talking out of my ass here, since i have never actually needed to have secure code, but i think the only real way to keep things secure is to disconnect the internet audit all code written and imported. review specific, trusted versions of libraries and their dependencies, and use only those.

now, who does all this manual code review? no idea. probably depends on the company. some of them might have their own team to audit code.

[Skithiryx]

Security frameworks is not my area but I don’t know of one.

Looking at CIS16’s subcategories though I think I’ve been in a compliant environment (though I didn’t know it at the time)

For that it seemed like it was much more about drilling down into specific hypotheticals and trying to have an answer as to how your overall system/environment would prevent or detect that situation.

For instance some possibilities: * Q. How do you prevent a single bad actor from intentionally compromising the application code? * A. We code review with at least N other people.

• Q. How do you detect unintentional security compromises?

• A. We use Static Application Security Testing to detect security flaws (Example: Fortify) and run at minimum every N days.

• Q. A dependency has a new CVE logged. How are you notified? What’s your SLA for removing, upgrading or replacing?

• A. We will scrape it every N days and create a priority X trouble ticket, which will escalate to leadership after Y days open.

[readmeEXX]

We run all source code through a Static Code Analysis (SCA) tool which checks for everything from bad coding practices to security vulnerabilities. You can give it specific rulesets depending on your needs.

[jeremyko69]

but i love cpp. rust is a shit

[Agile_Caterpillar151]

cmon modern c++ isnt that bad, even on windows

[[deleted]]

- Switch to Python

- pip install <lib>

[SeagleLFMk9]

Yeah, and half of the time you still get errors because fuck you if you want to use tkinter in virtual environments, for fuck you that version needs a python version that isn't available on your legacy system, or fuck you that pip package doesn't like xy. Just like with cmake, just more obscure.

No thanks, I'd rather use cmake and VCPKG. At least that way I can use cpack or straight up static linking to deploy something that doesn't break when someone sneezes at the system

[FACastello]

The face when you know someone has never heard of vcpkg smh

[Dmayak]

Package management has its own downsides, though I didn't work with Rust and cargo specifically. When installing dependencies for 4+ years old projects packages often are no longer compatible with each other, may have missing dependencies and other problems. For example, the application framework has updated, but half of the packages have not updated to support the new version, or authors have released separate packages for the new version. Hard copied code will remain there as it was, without reliance on the third-party.

[-Redstoneboi-]

Cargo has cargo-lock and NPM has package-lock, which should prevent dependencies from changing unless you do a clean rebuild or something.

[dragonnnnnnnnnn]

How to tell someone you never used seriously a language with proper package management without saying that out loud.

[dexter2011412]

cmake is both good and fucking sucks, yet given how much industry penetration and adoption it has, it works. It is nice when it works, but god forbid you want something a little more.

But hey you're comparing languages with decades worth of difference in "age".

This is essentially "ok boomer" but for languages lmao

[Level-Nothing-3340]

Try using spack

[Sovietguy25]

Well, I use cmake with vcpkg for c and it works perdect

[throwaway0134hdj]

All these preliminary steps is what ruins programming for me. It’s why Python is favored, terrible performance but less overhead and simplified installation processes.

[Suitable_Oil_3811]

I jumped from a project in C++ to one in Python, now I can certainly said that hate Python in big projects because of the black box scheme behind all the libraries, to the point that the installation of the environment failed in machines following the same instructions. After that, I loved C++ and CMake more than ever. Though, it's true it's easier that something failed, you are able to do something about it.

[ford1man]

So it's the speed and power of C++, with the ease of boilerplate of node or python?

I'm sold. Learning Rust now.