4 ms·
I'm not sure there's much to take away from this article. The author spends most of his words arguing against himself and then ends with a very confusing paragr
by willseth 3y ago
I'm not sure there's much to take away from this article. The author spends most of his words arguing against himself and then ends with a very confusing paragraph with a vague call to "understand what security means", a reference to "the growing movement toward legislation" (what legislation?), and the implication that we might be less secure, somehow. Maybe there is some subtext I'm supposed to know before reading, but on it's own, overall just incoherent.
- steveklabnik 3y agoI can speak to the “legislation” bit. The federal government is starting to take a position that “memory safety is good.” A few recommendations have come out of a few security-adjacent portions of the government, and this has caused quite a stir in at least the C++ community. Right now it’s more along the lines of “prefer a memory safe language over a memory unsafe language if possible” but some fear(/ others hope?) that the recommendations will eventually grow teeth. An example so you can see for yourself: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3215760/nsa-releases-guidance-on-how-to-protect-against-software-memory-safety-issues/ https://www.nsa.gov/Press-Room/News-Highlights/Article/Artic...
- willseth 3y agoThanks Steve. This strikes me as a reasonable recommendation, though it seems like generally the guiding metric should be whatever leads to fewer bugs and vulnerabilities (incl. tools, processes, etc).