[shanemhansen]

> But you'd actually have to try if you wanted Java to be able to write arbitrary memory or execute arbitrary code.

Depends on your definition of arbitrary. Higher level languages have higher level exploits. While injecting x86 shellcode into a java process is probably hard, many java applications have been vulnerable to serialization bugs which result in the execution of arbitrary bytecode.

Source: http://www.darkreading.com/informationweek-home/why-the-java...

[pcwalton]

Nobody is saying RCE is impossible in memory safe languages, just much less likely.

[askyourmother]

And this needs to be said more "RCE is possible in Rust", because sometimes it is portrayed in almost unassailable terms.

[pcwalton]

It also needs to be said that this is generally not a reasonable reason to pick C over Rust. Memory-safe languages are effective defenses against these flaws.