r/wg21
P3970R0 - Profiles and Safety: a call to action WG21
Posted by u/safety_profile_observer · 18 hr. ago

Document: P3970R0
Authors: David Vandevoorde, Jeff Garland, Paul E. McKenney, Roger Orr, Bjarne Stroustrup, Michael Wong
Date: 2026-01-16
Audience: EWG, SG12, SG20, SG23

Directions Group statement on safety profiles. The paper argues that SG23 and EWG have repeatedly pointed to Profiles as the direction, but the committee faces "a stream of uncoordinated proposals" not aligned with the framework. Calls on implementers to coordinate on framework support, proposes initial profiles (initialization, ranges, resources, education), and identifies harder targets (invalidation, arithmetic, concurrency). Notes an experimental implementation in a major compiler.

▲ 892 points (73% upvoted) · 68 comments
sorted by: best
u/paper_trail_2019 1 point 18 hr. ago pinned comment

Reminder: be civil. The paper authors sometimes read these threads. Rule 2.

u/safety_skeptic_2024 487 points 17 hr. ago 🏆🏆

Profiles were introduced to EWG in 2023. It is now 2026. The paper says there is "a specification and an experimental implementation is being conducted in a major C++ compiler." Unnamed. One compiler. Experimental. Three years of "this is the direction" and the deliverable is an unnamed experiment.

Meanwhile the paper tells other proposals to stop being "uncoordinated." Maybe the coordination should come with an implementation people can try.

u/profiles_framework_defender 198 points 16 hr. ago

The framework paper exists. The implementation guide is being written. Compiler work is happening. The DG is asking for more implementations, not claiming the work is done. "Call to action" is literally the title. The action hasn't happened yet. That's the point of the call.

u/safety_skeptic_2024 142 points 15 hr. ago

If the framework needs implementers to volunteer, maybe it should come with enough detail that they can start. The paper asks organizations with money and expertise to build it. That's not a technical specification. That's a fundraising pitch.

u/just_use_rust_already 342 points 17 hr. ago 🏆

Rust shipped memory safety in 2015. It's 2026. C++ is still publishing calls to action about maybe getting initialization checking if someone volunteers to implement it.

u/billion_lines_of_cpp 267 points 16 hr. ago

Rust started from scratch. C++ has billions of lines of existing code that can't be rewritten. Making an existing language safer without breaking the existing codebase is a harder problem than designing a safe language from nothing. Both are achievements. They're not the same achievement.

u/just_use_rust_already 89 points 15 hr. ago

The billions of lines aren't going to opt into profiles either. When's the last time your company turned on a new warning flag across the entire codebase?

u/billion_lines_of_cpp 54 points 14 hr. ago

New code can opt in. That's the point. Profile-clean new code interfacing with legacy code through well-defined boundaries. You don't boil the ocean. You build safe islands.

u/initialization_profile_fan 218 points 16 hr. ago

The initial profiles list is pragmatic. Initialization first - because nothing else works if you're reading uninitialized memory. Ranges second - because buffer overflows are the number one CVE category. Resources third - RAII enforcement. Education fourth - keep beginners out of dark corners.

These are achievable. The harder ones (invalidation, arithmetic) are flagged as requiring "serious static analysis." Honest about what's easy and what's hard. I respect that.

u/dangling_pointer_survivor 94 points 15 hr. ago

The invalidation profile is the one people actually want. "No access through dangling pointers" is the guarantee that would change how C++ is perceived by the security community. And it's in the "hard, requires serious static analysis" bucket. The easy profiles are useful but they're not what the White House report is asking for.

u/circle_cpp_watcher 176 points 16 hr. ago

Sean Baxter shipped Safe C++ in Circle with borrow checking, lifetime safety, and pattern matching. It works today. You can compile code with it. The DG paper mentions none of this. The "uncoordinated proposals" complaint presumably includes his work. A working implementation being called "uncoordinated" because it doesn't use the Profiles framework is a choice.

u/profiles_framework_defender 87 points 15 hr. ago

Circle's approach adds new language features (borrow checker, lifetime annotations, safe references). Profiles operate within existing C++ - no new syntax, no new type system. They're different strategies. The DG is advocating for the one that doesn't require learning a new language.

u/circle_cpp_watcher 67 points 14 hr. ago

One approach ships and works. The other is a call to action asking for volunteers. The committee can debate strategy. Users will adopt whichever one catches their bugs.

u/bjarne_paper_means_serious 148 points 17 hr. ago

Stroustrup is an author. When the creator of the language co-signs a "call to action" on safety with five other DG members, the committee pays attention. Whether you think profiles are the right approach or not, this paper is going to shape the next three years of evolution work.

u/education_profile_skeptic 112 points 15 hr. ago

An "education" profile that enforces a restricted version of C++ for novices. Core Guidelines as the inspiration. SG20 interested. This could be genuinely useful - "student mode" that bans raw pointers, raw new/delete, C-style casts, and half the footguns that make C++ hard to teach. Or it could be a moving target that never converges.

u/sg20_lurker 52 points 14 hr. ago

Teaching C++ would be radically different if I could tell students "compile with -profile=education and the compiler won't let you make the mistakes I'm about to spend two weeks explaining." The question is what goes in and what stays out. Every instructor will have a different opinion.

u/subset_of_superset_critic 96 points 14 hr. ago

The "subset-of-superset strategy" means profiles restrict what you can write (subset) while the language keeps growing (superset). The problem: every new feature that isn't profile-aware becomes a hole. Coroutines, modules, consteval, reflection - each needs profile integration. That's a perpetual maintenance burden on every profile as the language evolves.

u/profiles_framework_defender 48 points 13 hr. ago

New features default to profile-compatible unless they introduce new unsafety. Coroutines don't add new pointer dangling that doesn't already exist. Modules are safer by default (no macro leakage). The maintenance burden is real but it's proportional to how much unsafety the committee adds, which is exactly the pressure profiles are designed to create.

u/static_analysis_practitioner 78 points 13 hr. ago

The elephant in the room: lifetime safety (the invalidation profile) requires whole-program analysis or very conservative local analysis. Clang's lifetime warnings already exist and they're useful but limited. The paper acknowledges this is "not ideal as part of initial implementation experiments." Translation: the hard safety guarantee everyone wants is years away even after the framework ships.

[deleted] score hidden 12 hr. ago

[removed by moderator]

u/what_did_they_say 34 points 11 hr. ago

Something about Bjarne being out of touch. You know the drill.

u/paper_trail_2019 1 point 11 hr. ago

Rule 2. Take a breath.

u/government_mandate_watcher 64 points 15 hr. ago

The US government, the EU, and multiple national cybersecurity agencies have published guidance recommending memory-safe languages. C++ is on the "not recommended" list. Profiles are the committee's answer to that pressure. Whether they're technically the right answer matters less than whether they ship before the procurement guidelines harden.

u/compiler_implementer_anon 58 points 12 hr. ago

"We encourage implementers to coordinate and if possible collaborate to avoid inessential incompatibilities." I work on a major compiler. We haven't been contacted. The coordination the paper calls for would be welcome. The paper calling for it isn't the same as it happening.

u/raii_is_not_enough 47 points 14 hr. ago

The "resources" profile is literally just RAII enforcement. Every C++ style guide already says this. Every linter already checks for it. Making it a profile is formalizing what we've been doing for 20 years. Not exciting. But necessary if profiles are going to cover the basics first.

u/hardened_library_user 42 points 13 hr. ago

The ranges profile is interesting because it connects hardened standard library implementations (which already exist in libc++ and libstdc++) with compile-time prevention of raw pointer subscripting. You get both runtime bounds checking from the library AND compile-time rejection of ptr[i]. That's a meaningful safety improvement.

u/dg_mandate_questioner 38 points 11 hr. ago

Is a DG statement a direction or a mandate? The paper says "we face a stream of uncoordinated proposals" and calls for building "on the proposed Profiles framework." If someone brings a safety proposal that doesn't use profiles, does EWG now have political cover to reject it regardless of technical merit?

u/committee_process_nerd 24 points 10 hr. ago

DG statements are advisory. EWG can and does ignore them when the room disagrees. But a DG statement signed by Stroustrup, Vandevoorde, and McKenney carries weight. It's a strong signal, not a rule.

u/narrowing_conversion_hater 31 points 10 hr. ago

The arithmetic profile: no implicit narrowing conversions, no overflow or underflow. Straightforward to specify. Brutal to enforce on existing codebases. Every int x = some_long is a violation. Every unsigned - unsigned that wraps is a violation. This is the profile that will generate the most "false positive" complaints.

u/embedded_safety_matters 27 points 9 hr. ago

In automotive and aerospace, MISRA already enforces a restricted subset of C++. Profiles could standardize what MISRA does ad-hoc. If a profile for safety-critical systems aligns with MISRA, we'd have one set of rules instead of two. That alone would be worth the effort.

u/not_every_profile_is_safety 22 points 8 hr. ago
Please note that not every profile should be standardized and that not every profile will be safety related.

This is easy to miss. Profiles are a framework, not just a safety feature. Style profiles, performance profiles, ABI-compatible profiles. The framework is more general than the safety conversation implies.

u/open_source_plea 18 points 7 hr. ago
we encourage work on open source and on open implementation guidance

This is the most important sentence in the paper and it's the last one. If profiles ship only in proprietary toolchains, adoption will be slow and fragmented. Open source implementations are how C++ features actually reach developers.

u/concurrency_profile_when 14 points 6 hr. ago

"After that, more profiles should be defined and implemented, notably a concurrency profile." Data races are the other half of the safety story. Initialization and bounds checking are necessary but a concurrency profile would be transformative. That said, statically checking for data races in C++ is... ambitious.

u/this_is_why_we_cant 11 points 5 hr. ago

Three years of "profiles are the direction." Zero profiles shipped. The NSA publishes another guidance document. The EU adds C++ to its "use with caution" list. And we publish another call to action. At what point does the call to action become a call to panic?

u/skill_issue_42 7 points 3 hr. ago

*nervously glances at the 200 -Wno- flags in my CMakeLists.txt*

u/committee_gonna_committee 4 points 2 hr. ago

committee gonna committee