Quote:Memory safety vulnerabilities are a class of vulnerability affecting how memory can be accessed, written, allocated, or deallocated in unintended ways.iii Experts have identified a few programming languages that both lack traits associated with memory safety and also have high proliferation across critical systems, such as C and C++.iv Choosing to use memory safe programming languages at the outset, as recommended by the Cybersecurity and Infrastructure Security Agency’s (CISA) Open-Source Software Security Roadmap is one example of developing software in a secure-by- design manner.

Quote:At this time, the most widely used languages that meet all three properties are C and C++, which are not memory safe programming languages. Rust, one example of a memory safe programming language, has the three requisite properties above, but has not yet been proven in space systems.

(Feb 27, 2024 10:04 AM)Euaggelistes Wrote:  Thank you for sharing. It's interesting that the report doesn't really elaborate on what these "memory safe" languages are. What do they want developers to migrate to?

(Feb 27, 2024 10:06 AM)nodes Wrote:  They suggest Ruby a few times actually for this

(Feb 27, 2024 10:07 AM)Euaggelistes Wrote:  Ah...I was reading really fast, so I missed that. Thanks!

(Feb 29, 2024 05:00 AM)RexBlasen Wrote:  Thanks for sharing, I forgot the read up on this when I first heard about it...

(Feb 29, 2024 05:28 AM)nodes Wrote:  You're welcome. Will this affect you in any way if the government starts enforcing laws around memory management for coders?

(Feb 27, 2024 10:14 AM)nodes Wrote:  I am completely against this announcement overall. I understand why it is necessary, but they are so against C++/C for the sole reason that:
- because you can cause memory leaks / memory exploits, you shouldn't use it.

That is absolute nonsense to me. There are so many ways you can end up making programs that are memory-safe, it's sad that they are against a whole language that is responsible for not only programs, but other languages, operating systems, etc.

However, I can understand that they may feel that it's safer for Gov work, in Space for example, to use something that has less opportunities for dev mistakes than C or C++. I can kind of get behind that, but I didn't love the sentiment throughout the announcement video or PDF here.

(Feb 29, 2024 06:27 AM)RexBlasen Wrote:  Well, I'm not actually in the US but it's still concerning.
Commercially, I don't really work with low-level languages but it's still concerning. How far up the chain does it go? For example, the whitehouse website is Wordpress - Wordpress is powered by PHP - PHP (usually) runs on something like Apache which is built in C, so does this mean that Apache is obsolete etc? Or is it ok because Apache is old??
That's my thinking anyway, and I might be blowing it out of proportion.

I think it's daft regardless of it it affects me, there's some really talented programmers that specialise in these 'dangerous' languages and a lot of technical work will require these languages and their talented developers. Fuck using Ruby

(Feb 29, 2024 06:44 AM)InspectorGadget Wrote:  I think it's very ironic that US Gov viewpoint is "we shouldn't use C++/C as it can cause memory leaks / exploits" but are more than happy to allow most people a gun that is used to kill people and literally cause several mass shootings a week...

I didn't say that to start a debate on gun rights, but i do find it highly ironic that THIS is what the US gov decided is the priority lmao.

(Feb 29, 2024 06:52 AM)nodes Wrote:  haha that's a good point - it is odd, but at end of the day it's two different departments managing two different things.
I think it's more like a pre-existing cyber security department prioritizing this, more than the US gov shifting a focus from anything else to cyber.

(Feb 29, 2024 07:43 AM)InspectorGadget Wrote:  You've nailed it, it's defnetly a case of the left hand not knowing what the right hand is doing.