Yes, it's always safe to assume that some human will mess it up. Here, I would like to assume a development process with proper tooling (e.g., static analyzers) and organization (e.g., committer) to ensure that the devs are following the rules.

Can you elaborate more on the challenges in writing strictly safe code in C++, maybe give an example?

Thanks for mentioning the undefined behavior. That's something I haven't thought of and it definitely be harder to avoid/spot than raw pointers and arrays.

Except pointer arithmetic was never a problem in a professional context. I don't recall writing a pointer arithmetic or array out of bounds bug since forever. According to my version control, I seem to have written one in year 2006. Oh noes, this is unacceptable, I better switch to Rust...

You are correct that poorly-defined behavior is the main safety problem in C++, one that can't really be avoided due to the complexity of the language. If you need a safe language, you will therefore have to port to C which doesn't suffer from the same feature bloat and even then you have to use a safe subset of the language, because C is quite flawed too. The main difference is that in C we know all the flaws.

You're right! But this will always an issue with whatever language you choose. Java, Python, C#, Rust all can reference C/C++ code that internally uses, and often enough even externalizes these error-prone language constructs. Take the Python bindings for the NVIDIA Management Library as an example. It forces you to do manual memory management in Python.

Depending on 3'rd party code doesn't make Rust any safer, as long as Rust itself offers unsafe features which are heavily used by library developers. No matter what language it is, safety first principle is a key, other languages just don't require that many rules in the convention to ensure it.

At least exceptions are hard to ignore, and coredumps are easy to analyze. Forgetting to check on the global errno and continue the execution when something already went wrong is way more fun!

But yes, error handling in general also a pain point in programming. Even in safe languages.

Yeah they are hard to ignore for the users, who have to suffer the buggy mess you delivered, because you programmed in a language which supports exception handling. It's like building a skyscraper out of glass and signaling that there's a broken sink on level 55 by throwing a massive rock through all levels below and toppling the whole building, killing and destroying everyone and everything, completely out of proportion for the minor local error.

errno is ancient Unix crap from the 1970s so it's not really a suitable comparison. Obviously errno was one huge, skunky design mistake and that's not how you do error handling in the 1980s or later.

Proper error handling is rather done by returning a result code to the caller, so that errors/result remain local to the part of the program where they make sense, with loose coupling from totally unrelated parts of the program. The caller can then decide how to deal with the error, perhaps return an error further up into the call hierarchy - not necessarily the same type as the lower layer returned.

And so you end up with an error handler at the top layer of the program. Well-designed programs centralize all error handling there, at a single place, and they might also centralize decision making of which code to execute next at the same place.

If exceptions were only allowed to be thrown to the caller and not out in the wild, they might actually have been useful. But alas they were designed by very incompetent people who didn't know what they were doing. Why semi-modern languages decided to support exception handling is beyond me, we already knew it was a complete mess by the time Java was released in the late 90s.

Since exceptions are some kind of unannotated jump statements, I guess exceptions are harmful in C++ in combination with manual resource management because exceptions handled by upper-level code can result in memory leaks and other unclosed resources if not considered properly. So, I wouldn't necessarily see exceptions as the problem here, but rather using malloc/free style code.

And so you end up with an error handler at the top layer of the program. Well-designed programs centralize all error handling there, at a single place, and they might also centralize decision making of which code to execute next at the same place.

Actually, you don't want to handle all errors at a central place. It really depends on the context where an error is most suitably handled. For example, when calling a function, such as find_item_in_list that throws a NotFound exception if the item is not in the list, you probably want to handle that right in the caller and not somewhere in your main (you could also return null, but what if it's null that you're searching in your list?). Conversely, when you have some unrecoverable system error, you probably want the program to stop immediately and handle this in your main to provide the user with some useful information.

Java has an explicit distinction between these two kinds of errors. Exceptions are part of the function signature and have to be handled explicitly by the calling function. Runtime errors are not part of the function signature and are propagated upwards until some code (optionally) handles them.

I find error codes in C++ cumbersome to work with. Usually, I would like the return value to be something for me to process and it clutters my code with additional branches for checking the error code every time I call the function. So, personally I prefer exceptions over error codes.

However, I've come to like the Rust way of doing error handling. It does away with all these issues by simply wrapping the result value in an enum struct that is either a Result containing a result value or an Error with error information. You can choose to process the error in-place or propagate it upwards. Furthermore, the error is always part of your function signature, so there are no surprise exceptions from deep within some library.

Since exceptions are some kind of unannotated jump statements, I guess exceptions are harmful in C++ in combination with manual resource management because exceptions handled by upper-level code can result in memory leaks and other unclosed resources if not considered properly. So, I wouldn't necessarily see exceptions as the problem here, but rather using malloc/free style code.

Leaks caused by exception is one problem but far from the biggest one. The main problem is spaghetti programming execution - the program jumping from one place to another completely unrelated place - often without the programmer expecting it or with precautions in place. Exception handling is inherently broken by design and C++ is far from the only language suffering from it.

Actually, you don't want to handle all errors at a central place. It really depends on the context where an error is most suitably handled.

Yeah but that wasn't really what I said - I rather said that an error should be handled locally if that is possible - or in case it isn't, passed along the result to the caller. The error could also be handled locally but reported elsewhere. And so ultimately you will need a top level error handler. This means that user notifications, error logging and similar can be handled from one single place, likely attached to the GUI.

I find error codes in C++ cumbersome to work with. Usually, I would like the return value to be something for me to process and it clutters my code with additional branches for checking the error code every time I call the function. So, personally I prefer exceptions over error codes.

Error handling will always clutter down the code. It is extra functionality and so it will take space in the code like everything else. Not the must creative kind of code to write, but important none the less.

It adds no extra branches. Because a function using exception handling would still have to do if(error) throw rotten_tomatoes. If you move that branch to the caller side instead, the number of branches remain the same. The alternative: result = OK; .... result = error_code; ... return result; followed by if(result == error) in the caller code has the same number of branches. Also, once you have noted that a critical error occurred, the code is likely not performance critical from there.

Also note that catch(specific_exception) is implemented as a branch. catch(specific_exception) { } catch(...) is two branches, same with Java finally.

As a professional programmer you also have to weigh your rationales against each other. "Oh no I have to type some extra error handling code" is a weak argument for doing something. "Exceptions may crash and destroy every single thing in my program and cause the program counter to run havoc" is an incredibly strong argument for not doing using exceptions. Here application programmers have a lot of learn from mission-critical systems where you can't just shrug off bugs as if they are a natural phenomenon destined to happen. Bugs happen with bad program design and when using dangerous features implemented by misguided language designers, like exception handling.

In general, programmers who are afraid of typing extra text and uses that as an argument for their coding style should consider another career, because - surprise! - programming is all about typing text.

Again:

• Memory leaks is not a big problem and even when such bugs are present, there's a big chance that they are 'dormant' bugs which won't cause any erroneous behavior apart from increased RAM usage.

• Out of bounds bugs is not a big problem since they are easily found both by manual code review and static/dynamic analysis.

These are beginner-level bugs. They are not the reason why C++ is unsafe and they are not the reason why Rust is safe (in "safe mode").