V: Vlang is not safe to use for a production, Please track!

[Kreyren]

As discussed on discord and in https://github.com/vlang/v/issues/3567 vlang is not safe to use for a production system due known issues like memory leaks (and more?).

I want to use vlang on my project, but i HAVE TO be aware of ALL known security issues so that i could adapt the project for them.

Please make a tracking for all known issues that break production so that they can be tracked and adapted for development.

Thanks ^-^

[medvednikov]

Other than memory leaks which are finally going to be fixed by next week, I'm not aware of anything.

[elimisteve]

@medvednikov Relatedly, since V is translated to C before compilation, how can you ensure that there are no buffer overflows? (I don't know how bounds checking is implemented, but, is it?) Are you only outputting a safe subset of C?

Thanks!

[medvednikov]

Of course.

[Kreyren]

Other than memory leaks which are finally going to be fixed by next week, I'm not aware of anything.

To clarify there are currently 386 issues/requests marked with bug and it makes it very difficult to track critical issues like memory leaks since i can't find any reference to them anywhere other then asking on discord which only points to results like this which are not helpful:

It would help a lot if you could track these in a milestone or something so that i could warn my end-users about these issues (ideally referencing on upstream tracking with checking to see if any critical bugs are known to apply the warning message) in case i can't hotfix them.

[medvednikov]

All projects have bugs. Go has 1135 NeedsFix issues, doesn't mean it's not ready for production.

Like I said, I'm not aware of critical bugs other than memory leaks.

[iredmail]

Other than memory leaks which are finally going to be fixed by next week, ...

Next week? Oh no, this is not a marketing trick but a lie.

[Kreyren]

All projects have bugs. Go has 1135 NeedsFix issues, doesn't mean it's not ready for production.

Go is not a programming language under heavy development with relatively small team like vlang for it to be likely to get critical bugs that breaks production..

Or can i use vagrant on vlang or some tools to ensure it's safety on runtime?

[medvednikov]

You can use any tool you want. Valgrind will report 0 errors on all V programs and will be added to CI to keep it this way. As well as Clang analyzer, PVS, -Wall, etc.

Go is not a programming language under heavy development with relatively small team like vlang for it to be likely to get critical bugs that breaks production..

I was just commenting on your point about 386 bugs.

[medvednikov]

I've added a new label Security to track such issues.

So if you found something, please create a new issue using this label.

[Kreyren]

@medvednikov thank you! ^-^