Back

2026-03-14

What C++ proves: the failure of 'understand every line of code'

A recent YouTube video criticizing C++ made the rounds. It's about 40 minutes long, and it systematically dismantles C++ from top to bottom — from the 20 different ways to initialize a variable, to the header file nightmare, build system fragmentation, memory safety failures, standard library inadequacies, and the devastating conclusion that "if you like C++, you don't know it well enough."

The technical accuracy is surprisingly high. Let me go through a few points.


Technically accurate criticisms

The critique of the header file system is nearly flawless. That #include is a glorified copy-paste operation, that this causes One Definition Rule violations requiring header guards everywhere, that compile times grow exponentially — all correct. C++20 modules aim to fix this, but as the video notes, compiler support is still incomplete and industry adoption is distant.

The memory safety statistics are accurate. Google and Microsoft data show that roughly 70% of security vulnerabilities are memory-safety related. The NSA, CISA, FBI, White House, and EU have all issued official statements expressing concern about memory-unsafe languages. This isn't anti-C++ rhetoric — it's empirical data.

The standard library naming critique is valid. That vector is confused with the physics concept, that empty() is ambiguous between query and command, that names like RAII and SFINAE tell you nothing about what they do — these are widely acknowledged problems within the C++ community itself. STL designer Alex Stepanov himself admitted that vector was a naming mistake.

The std::unordered_map performance issue is also correct. Its linked-list bucket design is cache-unfriendly, and hash map implementations from Google's Abseil or Facebook's Folly are significantly faster. The claim that the regex implementation is "one of the worst in existence" is backed by benchmarks.

Build system fragmentation is accurately described. The absence of a standard compiler, build system, or package manager is a chronic C++ problem, and while CMake has become the de facto standard, its user experience is indeed terrible.


Exaggerated or missing context

Not every criticism is balanced.

Criticizing static_cast verbosity while calling Java's (int) casting "clean" is somewhat ironic. C++ made casting verbose precisely because C-style casts were too dangerous — it's intentional design to make intent explicit. The verbosity has a reason. Java's short casting syntax isn't necessarily a virtue.

The Rust comparison is mostly fair, but the section on Rust's drawbacks is proportionally short. Async Rust complexity, borrow checker friction, and game development community attrition are mentioned but take up roughly 1/10 the space of C++ criticism.

"If you like C++, you don't know it well enough" is a striking line, but it's logically unfalsifiable. If liking it means you don't know it, and disliking it means you do, then it's not an argument — it's a creed. Many developers who've used C++ for decades still acknowledge its strengths.


The really interesting point: the myth of "understand every line of code"

What struck me most about this video isn't something it says explicitly. It's a premise that runs through the entire 120 minutes:

"A programmer should understand every line of code they write."

This premise is an old norm of software engineering. It's the basis for code reviews, the foundation of "explain why this line is necessary," and the core argument of people who call vibe coding "dangerous."

But what this video demonstrates over 120 minutes is precisely the opposite: the language that most extremely pursued the philosophy of "understand every line" is C++, and the results are catastrophic.

Think about it:

  • C++ developers must "understand" that std::move doesn't actually move anything
  • They must memorize implicit conversion rules to "understand" that a string literal converts to bool
  • They must "understand" that the inline keyword means opposite things for functions versus variables
  • They must read the 2,000-page C++20 spec and "understand" it
  • They must read 800-page template textbooks and "understand" them
  • They must read 300-page initialization textbooks and "understand" them
  • They must read 300-page move semantics textbooks and "understand" them

And after all that "understanding" by the best engineers at FAANG companies, what's the result?

70% of security vulnerabilities are memory safety issues.

This isn't a failure of education. It's not a failure of culture. It's a failure of technology. Telling people to "just understand harder" when the tool exceeds human cognitive capacity is not a solution.


So what about vibe coding?

This is where it connects.

The core argument against vibe coding goes like this:

"If you don't understand the code AI generates, it's dangerous."

That's true. But this argument implicitly assumes that "code humans write by hand is understood." What the C++ video demonstrates over 40 minutes is that this assumption is false.

C++ developers don't fully understand their own code either:

  • They must "pray" that the compiler performs copy elision
  • Almost nobody has read the internals of std::string (the video calls it "a fool's errand")
  • Most developers have never audited their third-party library code
  • They can't be certain when undefined behavior will trigger

"Understanding every line of code" was always a myth. Vibe coding didn't break this myth. Vibe coding merely made it visible that the myth was already broken.


So is vibe coding safe?

"Safe or dangerous" is the wrong question. The right question is "compared to what?"

Compare a vibe-coded web app in Python to hand-written system software in C++:

Vibe coding (Python/TS)Manual coding (C++)
Memory safetyGuaranteed by GCManaged by developer (high failure rate)
Buffer overflowImpossible at language levelRoutine occurrence
Type safetyGood with TypeScriptEroded by implicit conversions
Code comprehensionCan be lowClaimed to be high, but questionable
Time to shipFastVery slow
Security vulnerability rateRelatively low70% (memory safety)

This is an extreme comparison, of course. C++ and Python serve different purposes. But the point is that language choice and tool choice have far greater impact on safety than coding methodology (vibe coding vs manual coding).


The right scope of "understanding"

"You should understand your code" isn't wrong. But the scope of understanding is what matters.

Understanding every line of every piece of code is impossible, and attempting it is counterproductive. What actually matters:

  1. Understanding at system boundaries: input validation, authentication, data integrity — these require human review regardless of how code was produced
  2. Architectural understanding: component relationships, data flow, failure propagation — this doesn't emerge from prompts
  3. Understanding intent: why this code exists, what it solves — this is closer to understanding the problem than reading the code

Understanding line-by-line implementation details is the least important item on this list. And that's precisely what vibe coding trades away.


Conclusion

The biggest lesson from this C++ critique video isn't about C++ itself.

It's that when you push the philosophy of "understand and control everything" to its extreme, you create a monster that nobody can understand or control.

C++ is the name of that monster.

To those who call vibe coding "childish," "dumb," or "unsafe," I'd ask: is C++ mature, wise, and safe? This language that evolved for 40 years under the philosophy of "understand your code" produced a world where 70% of security vulnerabilities are memory bugs.

Writing simple code in a safe language, with AI assistance, isn't childish. It's abandoning the vanity of "I'll understand everything myself" and choosing safety nets that actually work.

What matters in the end isn't who wrote the code, but what happens when that code fails. And by that measure, AI-generated code in a language with garbage collection and bounds checking is — often — safer than code a human wrote by hand in C++.