11 ms·
NSA guidance on how to protect against software memory safety issues [pdf]
- mark_l_watson 4y agoQuoting myself from a similar thread today: Good advice. As a Lisp developer, I have used Swift and it seems like a nicely designed language, very good tooling on macOS/iPadOS and OK on Linux. Go, Rust, and others are also good. Off topic, but I thought it sad how once 9/11 happened with the side-tracked war on terrorism, the NSA and FBI apparently (from my private citizen perspective) stopped doing much of the previous great work on public support for computer security, going after international computer crime cartels, etc. As a US taxpayer, I would like to see them prioritize that type of work.
- CTDOCodebases 4y agoMaybe that was deliberate. It doesn’t make sense to teach terrorists how to secure their systems if you need to exploit these systems to achieve your mission. Now that Chinese, Russian and North Korean actors are putting in work and causing real economic damage in the west it looks like defence is starting to hold some value again.
- bugfix-66 4y agoTLDR: Transition from C to Go. Go was designed by (among others) the father of Unix, Ken Thompson, with an understanding of the mistakes of C and C++. Despite getting hilariously little respect here on Hacker News, the language is (for many purposes) an excellent replacement for C. (Yes, yes, I know you disagree. Tell me more about how C++ is necessary and all the time you spend fighting it is actually a huge win! Please tell me how slow garbage collection is, all evidence to the contrary!) Go reads from, and writes to, variable-sized blocks of memory through (pointer, length, capacity) triples, known as "slices". A Go slice "[]int" is essentially a C struct like this, passed around in 3 registers: struct IntSlice { int* pointer; ssize_t length; ssize_t capacity; }; Bounds checking in Go is easily disabled (pass -B flag to the compiler) but almost nobody does so because the performance benefit is miniscule. With bounds checking and garbage collection, Go avoids almost all memory-related bugs. You can understand Go as C redesigned for a world where parallel computing (e.g., dozens of CPU cores) is commonplace, and the benefits of safe code outweigh the tiny costs. We're not using 80286 chips anymore. We can afford safety.
- tsujamin 4y agoI've spent my last few weeks writing a platform in Go. Buffer management/strong typing is definitely an improvement on C. Shame about tall the null-pointer-exceptions though :') In all seriousness though it does seem to mitigate a lot of exploitable memory corruption vulns, perhaps not memory-corruption-caused Denial-of-Service vulnerabilities as well as Rust et all maybe.
- djbusby 4y agoGo gets little respect on HN? We're not reading the same threads.
- bugfix-66 4y agoObviously we aren't!
- djbusby 4y agotouché
- antegamisou 4y agoIt's nowhere nearly as hyped as Rust is here. Which is absurd considering Go is a more appropriate alternative to C. Even K from K&R uses it! https://youtu.be/VVpRj3Po6K4 https://youtu.be/VVpRj3Po6K4
- galangalalgol 4y agoWhy do people select c? I assume it is because it is the only compiler they have for some target hardware, or that they are working in a codebase like the Linux kernel. For the former go won't help. Tinygo may help some day, but for any weird new chip the first thing they make is a c compiler. The linux kernel accepts rust, or will next year. It does not accept go. So Torvalds at least disagrees it fits there. Go has plenty of uses, but writing microcontroller firmware and device drivers are not among them. And why else would you pick c?
- scj 4y agoThe term "memory safe language" (also used in the "Securing Open Source Software Act") is a misnomer. The report kind of acknowledges this "Even with a memory safe language, memory management is not entirely memory safe" but then presses on with the term anyway. I think they're trying to combine the concepts of languages that have GCs and prevent buffer overflows into a catch-all term, but "memory safe language" isn't a good choice. Non-programmers might take the term at face value. It's kind of like using the term "safe flame thrower", except no one would be lulled into a false sense of security with that one. Don't get me wrong, I'd rather use a "safer flame thrower" than a "flame thrower", but I also wouldn't trust anyone selling me a "safe flame thrower". The above is my best Dijkstra impersonation.
- zelon88 4y agoNon programmers reading this will start throwing it around at meetings prompting some kind of explanation or response from more technical teams. This pressure on the technical teams will probably result in a net reduction of memory errors over time.
- recuter 4y agoAs in the managers will forget about this and move on to the next fad shortly thereafter?
- rowanG077 4y ago"safe" doesn't mean "cannot go wrong". See terms such as safety belt or safety shoes, no one expects those to be infallible. It's simply an extra layer of defense.
- IshKebab 4y agoWhat about safety net or safety belt or... a safe? None of those are infallible either. "Memory safe language" is a perfectly good term for the moment since most languages fall square into "completely unsafe" or "completely safe with the ability to be unsafe in special circumstances". I don't know of any that are "fairly safe". Maybe something like Carbon will be like that.
- 4y ago
- pornel 4y ago
- tsujamin 4y agoDon't let the [victim memory-spaces] win!
- dang 4y agoUrl changed from https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3215760/nsa-releases-guidance-on-how-to-protect-against-software-memory-safety-issues/ https://www.nsa.gov/Press-Room/News-Highlights/Article/Artic..., which points to this.
- DSingularity 4y agoAmazing how little things have changed. Till today, ASLR and some basic CFI is all we have?
- rodgerd 4y agoTo steal a comment by Matthew Garret, "No way to prevent this, says users of only programming language where this happens regularly".
- DSingularity 4y agoYeah exactly.
- helloooooooo 4y agoStack cookies, CET(shadow stack) on Windows, XFG in some cases, non-deterministic heaps etc…
- DSingularity 4y agoLots of important stuff. But also old.
- yazzku 4y agoUnderwhelming report. Boils down to "rewrite it in <memory safe language>; but be careful, even those allow unsafe regions". Also surprising: no mention of Ada/Spark, the language people use to guide rockets and pacemakers? Seems pretty damn safe to me, and it handles more than memory safety, such as integer arithmetic.
- halffaday 4y agoTo your point, you should probably not do anything the NSA tells you to do. A spy agency’s endorsement of Rust is not to its credit.
- ClumsyPilot 4y agoBorders on: Histler was vegan, don't be vegan.
- tialaramex 4y agoIf I tell you to jump off a bridge so you do that, you're unwise because you obeyed my instructions without thinking. If I tell you not to jump off a bridge so you do it, you're still unwise because now you're just defying my instructions without thinking. Maybe the C++ bridge isn't on fire, but if you think you can smell smoke you wouldn't be alone.
- midislack 4y ago
- felipemesquita 4y agoRubyTM is a registered trademark of O’Reilly Media Inc. in the United States and/or other countries
- deafpolygon 4y agoThis is the NSA here. Chances are you probably don't want to use memory safe languages now.