[Hackers]

https://www.whitehouse.gov/wp-content/up...Report.pdf

Example of how the future may change can be read between the lines here:

Memory safety vulnerabilities are a class of vulnerability affecting how memory can be accessed, written, allocated, or deallocated in unintended ways.iii Experts have identified a few programming languages that both lack traits associated with memory safety and also have high proliferation across critical systems, such as C and C++.iv Choosing to use memory safe programming languages at the outset, as recommended by the Cybersecurity and Infrastructure Security Agency’s (CISA) Open-Source Software Security Roadmap is one example of developing software in a secure-by- design manner.

At this time, the most widely used languages that meet all three properties are C and C++, which are not memory safe programming languages. Rust, one example of a memory safe programming language, has the three requisite properties above, but has not yet been proven in space systems.

I recommend reading this article if you are planning on working on gov projects or want to get ahead of any future regulation changes. It's totally possible that companies will be required to ensure & prove memory-safe programs in the future, so requirements for what developers must do may get more strict. we'll see!

[Euaggelistes]

Thank you for sharing. It's interesting that the report doesn't really elaborate on what these "memory safe" languages are. What do they want developers to migrate to?

[Hackers]

Thank you for sharing. It's interesting that the report doesn't really elaborate on what these "memory safe" languages are. What do they want developers to migrate to?

They suggest Ruby a few times actually for this

[Euaggelistes]

They suggest Ruby a few times actually for this

Ah...I was reading really fast, so I missed that. Thanks!

[Hackers]

Ah...I was reading really fast, so I missed that. Thanks!

I am completely against this announcement overall. I understand why it is necessary, but they are so against C++/C for the sole reason that:
- because you can cause memory leaks / memory exploits, you shouldn't use it.

That is absolute nonsense to me. There are so many ways you can end up making programs that are memory-safe, it's sad that they are against a whole language that is responsible for not only programs, but other languages, operating systems, etc.

However, I can understand that they may feel that it's safer for Gov work, in Space for example, to use something that has less opportunities for dev mistakes than C or C++. I can kind of get behind that, but I didn't love the sentiment throughout the announcement video or PDF here.

[RexBlasen]

Thanks for sharing, I forgot the read up on this when I first heard about it...

[Hackers]

Thanks for sharing, I forgot the read up on this when I first heard about it...

You're welcome. Will this affect you in any way if the government starts enforcing laws around memory management for coders?

[RexBlasen]

You're welcome. Will this affect you in any way if the government starts enforcing laws around memory management for coders?

Well, I'm not actually in the US but it's still concerning.
Commercially, I don't really work with low-level languages but it's still concerning. How far up the chain does it go? For example, the whitehouse website is Wordpress - Wordpress is powered by PHP - PHP (usually) runs on something like Apache which is built in C, so does this mean that Apache is obsolete etc? Or is it ok because Apache is old??
That's my thinking anyway, and I might be blowing it out of proportion.

I think it's daft regardless of it it affects me, there's some really talented programmers that specialise in these 'dangerous' languages and a lot of technical work will require these languages and their talented developers. Fuck using Ruby

[InspectorGadget]

I am completely against this announcement overall. I understand why it is necessary, but they are so against C++/C for the sole reason that:
- because you can cause memory leaks / memory exploits, you shouldn't use it.

That is absolute nonsense to me. There are so many ways you can end up making programs that are memory-safe, it's sad that they are against a whole language that is responsible for not only programs, but other languages, operating systems, etc.

However, I can understand that they may feel that it's safer for Gov work, in Space for example, to use something that has less opportunities for dev mistakes than C or C++. I can kind of get behind that, but I didn't love the sentiment throughout the announcement video or PDF here.

I think it's very ironic that US Gov viewpoint is "we shouldn't use C++/C as it can cause memory leaks / exploits" but are more than happy to allow most people a gun that is used to kill people and literally cause several mass shootings a week...

I didn't say that to start a debate on gun rights, but i do find it highly ironic that THIS is what the US gov decided is the priority lmao.

[Hackers]

Well, I'm not actually in the US but it's still concerning.
Commercially, I don't really work with low-level languages but it's still concerning. How far up the chain does it go? For example, the whitehouse website is Wordpress - Wordpress is powered by PHP - PHP (usually) runs on something like Apache which is built in C, so does this mean that Apache is obsolete etc? Or is it ok because Apache is old??
That's my thinking anyway, and I might be blowing it out of proportion.

I think it's daft regardless of it it affects me, there's some really talented programmers that specialise in these 'dangerous' languages and a lot of technical work will require these languages and their talented developers. Fuck using Ruby

I have a feeling it's going to go like this (to use your apache/php example):
- Apache and PHP would be required to show memory safety to be released as a commercial or open source codebase
- C/C++ could remain as-is but people wanting to release products or sell programming as a service might be required to prove memory safety

I think it'll be 'layered' in terms of how regulations are rolled out. Enterprise / commercial software will probably start with tax breaks for memory safety, followed by rules.

I think it's very ironic that US Gov viewpoint is "we shouldn't use C++/C as it can cause memory leaks / exploits" but are more than happy to allow most people a gun that is used to kill people and literally cause several mass shootings a week...

I didn't say that to start a debate on gun rights, but i do find it highly ironic that THIS is what the US gov decided is the priority lmao.

haha that's a good point - it is odd, but at end of the day it's two different departments managing two different things.
I think it's more like a pre-existing cyber security department prioritizing this, more than the US gov shifting a focus from anything else to cyber.

[InspectorGadget]

haha that's a good point - it is odd, but at end of the day it's two different departments managing two different things.
I think it's more like a pre-existing cyber security department prioritizing this, more than the US gov shifting a focus from anything else to cyber.

You've nailed it, it's defnetly a case of the left hand not knowing what the right hand is doing.

[Hackers]

You've nailed it, it's defnetly a case of the left hand not knowing what the right hand is doing.

I think a lot of people think government is some cohesive unit when in reality it's full of people just like you or I, and a lot of people are winging it as they go, unaware of the movement of the machine that is government and so head-down on only their own desks.