5 ms·
US Government may require open source software to use memory safe languages
- zgs 3y agoHa ha ha. Plenty of OSS is created outside the USA. Good luck applying any such mandates.
- 5e92cb50239222b 3y agoI skimmed through the document and don't see anything about them trying to force anyone to use memory safe languages. Looks more like "let's lead the way with using memory safe languages and good security practices, and think how we can encourage others to follow" which is a pretty good thing IMHO.
- jdougan 3y agoWhile I could see making this a requirement for USG usage, it seems like pretty big overreach outside of that. It would also interfere with the steady supply of 0days the NSA et. al. need.
- api 3y agoPlease change this incorrect click bait title. It’s a project to encourage their use. I have also heard about them being required in the future in government roles that are security sensitive which is quite reasonable.
- lloydatkinson 3y agoBad title then
- tomohawk 3y agoLet them. The faster they put this in place, the faster they will learn the consequences of their incompetence.
- mschuster91 3y agoUsing memory-safe languages eliminates entire classes of bugs, and this here is where the real money is: > Supporting rewrites of critical open-source software components in memory safe languages There is so, so much open-source software in dire need of funding. Actually getting someone to pay for maintenance - even if it is the US government - is a good thing. Relevant xkcd: https://xkcd.com/2347/ https://xkcd.com/2347/
- tomohawk 3y agoThat's all we need. A version of sqlite that takes 10x more memory and cpu. And at the same time is incompatible and unusable.
- joeatwork 3y agoI’m not seeing “require” in this document. It looks like the document is proposing education and funding for memory safe projects here.
- chiph 3y agoFollowing the link to the whitehouse.gov cybersecurity policy doc, it looks like this is for Strategic Objective 3.4 - USE FEDERAL GRANTS AND OTHER INCENTIVES TO BUILD IN SECURITY. (pdf warning): https://www.whitehouse.gov/wp-content/uploads/2023/03/National-Cybersecurity-Strategy-2023.pdf https://www.whitehouse.gov/wp-content/uploads/2023/03/Nation... And I don't have a problem with this. Years ago the National Security Agency contributed the SELinux kernel module, which improved the security of Linux - not only for Americans, but the entire world. I see this as something that the federal government has identified as a problem and they're asking for input on what to fund. And since it's OSS, everyone benefits.
- matt3210 3y agoRust is memory safe if you chose to use it that way. So is c/c++. Rust has no “defined behavior”, unlike c/c++ which has clear defined behavior (via the standard). Yes I jump to rust when it’s not mentioned… copium
- tester756 3y agoYou can argue endlessly about nuances yet people are being spied on because of mem issues
- LapsangGuzzler 3y ago> As highlighted in the National Cybersecurity Strategy and its Implementation Plan Initiative 4.2.1, the ONCD has established an Open-Source Software Security Initiative (OS3I) to champion the adoption of memory safe programming languages and open-source software security. This says nothing about "requiring" OSS to use memory safe languages. This headline is misleading.
- mrkeen 3y ago> In 2021, following the aftermath of the Log4Shell vulnerability > Supporting rewrites of critical open-source software components in memory safe languages Let's get everyone onto this Java thing I've been hearing so much about.
- Saphyel 3y agoWhat languages are memory safe? or are they avoiding to say Rust?
- candiodari 3y agoI'm going to change the license on my products to "You are NOT allowed to use this. Don't ask. Don't use" It's not like people are suddenly going to respect licenses.