15 ms·
The Case for Memory Safe Roadmaps
- userbinator 3y agoI'm cynically thinking "because they can now target the runtimes instead, and get far more value from their exploits".
- Rebelgecko 3y agoNSA is like the governmental version of the "inside you there are two wolves" meme One wolf that wants to help ensure that American computers are secure And one wolf that wants to hoard as many 0-days as possible
- breezedream 3y agoI used to work for this agency and your description is the most apt way to characterize the dichotomy between SID (SIGINT) and IAD (information assurance) I can think of.
- hospitalJail 3y agoAt least my usecase has C completely disconnected from the internet. I have no idea how this is going to work at the OS level.
- wyldfire 3y agoWhat is the "this" referred to here?
- deleted 3y ago[deleted]
- tines 3y agoThe title of the post: using memory-safe languages.
- wyldfire 3y agoSo it's your contention that the comment should read, "At least my usecase has C completely disconnected from the internet. I have no idea how [using memory-safe languages] is going to work at the OS level." I struggle to understand the comment. Do these two sentences relate to one another or is the second one a non-sequitur?
- dharmab 3y agoBased on early days of Rust in the Linux kernel, the segmentation of safe and unsafe code can significantly reduce the surface area within a kernel.
- carlmr 3y agoI mean it's obvious why it works. The less code that has to be heavily scrutinized for memory issues, the more the few people that can scrutinize such code can focus on the parts that still need that level of scrutiny.
- ethbr1 3y agoThat was the most brilliant part of Rust lang design, when I thought about it. There will always need to be unsafe ops in highest performance, low level coding. But in the vast majority of use cases, there only need to be a few. So huge security win being able to isolate those vs "somewhere in the entire codebase."
- candiddevmike 3y agoDo you rewrite the Linux kernel as-is in Rust or try something new? Would/should a Linux in Rust look the same?
- lambdaone 3y agoAs other commenters have said, you can do it a bit at a time, converting non-core kernel code to Rust at the edges. Another route to memory (and other) safety would be the C -> WASM -> C route that effectively rewrites/transpiles code to operate within its own sandbox, which also has the advantage that it could at some later date support modules written in languages other than C.
- Zambyte 3y agoI realize this is beating a dead horse, but it really is a shame that microkernels didn't win for human-facing Unix systems. This issue was recognized and basically solved decades ago, and we're still almost there.
- andrewmutz 3y agoCrossing an air gap hasn't stopped a determined attacker in the past: https://en.m.wikipedia.org/wiki/Stuxnet https://en.m.wikipedia.org/wiki/Stuxnet
- baseballdork 3y agoLet's be real. Creating an air gap hasn't stopped a very few, unlimited resource, APTs. Don't let perfect be the enemy of good enough.
- zaphar 3y agoTo really be real if air-gapping is a significant mitigation for your risk profile then you are likely the target of one of those rare APT's. You should probably also be using a memory safe language if you think you need air gapping.
- baseballdork 3y agoI agree, but I don't think the OP was saying APTs are in their threat profile.
- checker659 3y agoYou can shoot yourself in the foot as well. Memory safety isn't just about malicious thirdparty code.
- adrianN 3y agoA lot of industrial automation was built with an offline usecase in mind. Then someone invented the IIoT.
- stjohnswarts 3y agoThe Internet Internet of Things?
- wyldfire 3y agoIIoT stands for "Industrial Internet of Things"
- wodow 3y agoTheir "Appendix: Memory Safe Languages" lists: C#, Go, Java, Python, Rust & Swift
- candiddevmike 3y ago[flagged]
- chewmieser 3y agoOh boy... Nothing is mandated here. These are just suggestions from experts. Don't take them if you don't want to.
- synergy20 3y agowait for gov contract projects mandate them in the fine prints, it's a signal that is serious enough for anyone interested in doing any software-related business with gov, for them, this is nearly the same as 'mandated'
- chewmieser 3y agoThere actually was a mandate for government work in the past with Ada. This is not a mandate. Even that mandate did not appear to fundamentally change the landscape beyond government work.
- zaphar 3y agoI for one would prefer that government projects set this kind of requirement. I don't want my government software implemented in C++. If they are the customer they should require that the projects do everything they can to eliminate bugs caused by memory unsafety. Using a Memory Safe language is one of the easiest ways to do so.
- mikeyouse 3y agoThat’s just a customer with requirements.. like all customers.
- ianlevesque 3y agoEncouraging. I hope the increasing drumbeat of awareness and advocacy around this reaches a critical mass soon. I'm not naive enough to think it will solve all security problems, but it will reduce the attack surface so, so much.
- elromulous 3y ago[flagged]
- dgacmu 3y agoThere's an important difference between an opaque "trust us" recommendation where it's broadly impossible to verify the claim (e.g., Dual_EC_DRBG), and one such as this which is fairly anodyne and merely intended to put more weight behind getting people to move forward in their choice of implementation languages. The NSA's split offensive/defensive responsibility is bad but that doesn't affect recommendations such as this.
- elromulous 3y agoSure. The problem is that externally one is left guessing which team something came from. I agree that this is a decent recommendation, but it would be much easier if those two responsibilities (offensive vs defensive) were two distinct agencies.
- chewmieser 3y agoWho would you want these recommendations to come from? There's nothing wrong with a recommendation to use open, auditable tools. Be skeptical, but also I would expect this message to come from them.
- smolder 3y agoWell, fortunately this was obviously a good idea already, and we don't really need to wonder much about their intent.
- czbond 3y agoI was surprised to learn NIST also has a list of safer languages, and did not expect their suggestions: https://www.nist.gov/itl/ssd/software-quality-group/safer-languages https://www.nist.gov/itl/ssd/software-quality-group/safer-la...
- jorvi 3y agoYou can think of the NSA as being red team / blue team. Red team wants to hack everyone with a negative value add for America, blue team wants Americans (mostly companies) to be as safe as possible from digital attacks. This seems one of those blue team suggestions.
- champagnepapi 3y agoBut how are we going to trade stocks in nano seconds without C++?!
- huytersd 3y agoYou’re not. C++ isn’t going anywhere in certain industries.
- anonymoushn 3y agoA lot of shops do this in Java. Rust and Zig are usable but nobody's going to switch.
- logicchains 3y ago>A lot of shops do this in Java Absolutely not in the memory-safe subset of Java though.
- anonymoushn 3y agoHaha, it's rough when you don't even get arrays of structs!
- ryao 3y agoWhat is the memory-safe subset of Java? Java is memory safe by definition. Sadly, the definition might not give people what they want, which is bug-free code.
- 3y ago
- jmclnx 3y agoI advise training programmers instead of throwing them in front of a screen without any training. Companies these days provides no training at all. When I was hired over 40 years ago, I spent plenty of time being trained for my first 3 months. Now, nothing, and you if you want to train a new person, you do it on your own time.
- synergy20 3y agoabsolutely correct, in fact now some new hires are expected to do a few git-commit the first day(looking at you, Meta). no wonder so many bugs here and there.
- disgruntledphd2 3y ago> absolutely correct, in fact now some new hires are expected to do a few git-commit the first day(looking at you, Meta). Meta have a phenomenally good training program, called Bootcamp for basically everyone in engineering, so they're probably not the example you're looking for.
- synergy20 3y agoI recall meta expects new hires to do first commit the first day, not sure how its training will help in this scenario, this is in no way saying meta has no good training, it just does not add up here though.
- viraptor 3y agoWhat kind of commit though? We expect a first commit on the first day. The commit adds you to the maintainers list in readme and grants you some new roles after merging. It is not a "solve this user's issue" kind of commit.
- 0cf8612b2e1e 3y agoHow is that possible? It takes over a week just to get a new employee configured. Laptop, IDE, permissions to the hundred needed things, etc. Let alone opening up an unfamiliar codebase. Unless it is a “hello world” commit to confirm tooling is operational, I have strong doubts.
- Woshiwuja 3y agoLets go back to C guys
- lolive 3y agoThe truth about [Unix and] the C language: https://www-users.york.ac.uk/~ss44/joke/c.htm https://www-users.york.ac.uk/~ss44/joke/c.htm #joke #hilarious
- pier25 3y agoCorrect me if I'm wrong... But don't these types of memory attacks require local access to the machine?
- Filligree 3y agoAbsolutely not. You’re confusing it for Spectre, probably.
- pier25 3y agoThe article mentions: > Memory safety vulnerabilities are coding errors affecting software’s memory management code in which memory can be accessed, written, allocated, or deallocated in unintended ways. How can you do any of this without software running in the local machine? Honestly asking.
- estebank 3y agoA specially crafted networking package or file can cause a vulnerable application to get confused enough to interpret input meant to represent data as binary code to be executed. If you have an application that doesn't interact with any inputs, yes, you can avoid a lot of exploits. If the vulnerable application runs in a server, you might be temporarily safe in your local machine, until that server starts being used as a delivery mechanism against all its clients.
- thinkharderdev 3y agoTo take a very simple example (which won't work on modern OS with ASLR): 1. You have a service that takes some user input 2. The service allocates a buffer on the stack for 20 bytes (the max input allowed) 3. Service doesn't actually validate that the user input is < 20 bytes 4. It writes the input into the buffer, but keeps writing past the end of the buffer. 5. It eventually overwrites the return pointer so now the user input can control where the execution jumps to on return 6. In the user input, the malicious user includes some shell code to do any arbitrary thing they want. 7. The overwrite the return pointer to jump back into the shell code and now they are executing arbitrary code in the server process. This sort of thing was embarrassingly easy to do on old linux kernels before ASLR was implemented. Now it is dramatically harder because there are all sorts of countermeasures in place to prevent it (ASLR, stack canaries, executable vs non-executable memory, etc). To get a sense of what a more modern real world exploit looks like, give https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... a read.
- lambdaone 3y ago"Undefined behavior" in general is a nightmare. After memory safety, the next target should be the enforcement of underflow/overflow trapping. With the exception of the intentional use to implement modular arithmetic, underflow/overflow should always be an error condition.
- OrvalWintermute 3y agomost consumer operating systems are inherently non-deterministic which I put right in there next to undefined behavior (some people say it is a different thing).
- conradludgate 3y agoIt is a different thing. Non determinism is different to undefined behaviour. Undefined behaviour can cause miscompiles which can break the expected logic of a program. In the worse case, maybe the compiler optimises away your password validation because it has decided that the failure branch is undefined behaviour. Non determinism can lead to logic bugs, but it can't magically introduce new logic into the program like UB can as part of optimising
- logicchains 3y agoNot everything is a server facing malicious actors. Forcing underflow/overflow trapping would absolutely harm optimisation and performance for use-cases where security is a non-issue.
- brookst 3y agoI want to agree, but I’ve seen too many cases where code written for a narrowly scoped purpose finds its way into a totally different environment where the original assumptions no longer hold. Maybe it’s worth a tax on constrained use cases in the name of having fewer time bombs out there?
- cultureswitch 3y agoThe main problem with signed overflow being UB is that it's an opportunity for compilers to blatantly do adversarial language lawyering against the programmer in order to enable optimisations. When it comes to unsigneds, there's no such problem (and this is in fact the real reason why anything that can be unsigned in C/C++ should be unsigned).
- evrimoztamur 3y agoConfused about Python in particular considering a lot of powerful and common dependencies in the ecosystem starting out from numpy and friends all have C/++ components to them for performance improvements. Surely this is a vector to be considered?
- SethMLarson 3y agoPython itself is memory-safe, but you're right that a good chunk of the packaging ecosystem uses memory unsafe languages for performance and interop. The Python Software Foundation noted this in our response to the US Government RFI on open source security. There are efforts to make using Rust easier as a systems language for Python packages and some security-critical packages like 'cryptography' have migrated to Rust.
- pookha 3y agoThat's the irony in all of this. The Fort is sprinkling their wisdom down upon the masses and proclaiming that C++ is unsafe while arguing for a language that's a wrapper for c++ developers...Reminds me of John Gall's book about systems "The system itself does not do what it says it is doing."
- DeathArrow 3y agoIsn't C++ with RAII reasonably safe? I tried to learn/like Rust but it's against how I use to think. If no friendlier safe high speed programming language appears, I rather use C/C++ and trade safety for friendliness.
- zaphar 3y agoIf you have no users then go for it. However if you do then you are doing those users a disservice by exposing them to unnecessary risk. Maybe the risk is mitigated in other ways. Your software runs as a cli and not a service. It doesn't process outside input. It is run in an ironclad sandbox. But honestly, if you think the way C++ with RAII want's you to then you should already be following the rules that Rust want's you to follow for the most part.
- binary132 3y agoso what you’re saying is proper C++ is fine?
- zaphar 3y agoWhat I'm saying is that if you are sufficiently smart then you could concievably write perfectly safe C++. But since almost no one in practice has ever been able to be sufficiently smart consistently enough to ship C or C++ code that doesn't have memory safety issues, I don't trust anyone to do so and would rather people stop writing stuff in them when there are better languages to use where I don't have to trust you as much.
- binary132 3y agoHere’s what Stroustrup says: https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2022/p2687r0.pdf https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2022/p26...
- woodruffw 3y agoRAII is great (especially as a developer’s aid), but I don’t think it’s had a huge effect on memory unsafety: it’s still very easy to UAF in a RAII-only codebase, thanks to all of the flexibility C++ allows in constructors and destructors (and unintuitive behavior in moved-out-of objects). Rust is generally perceived as having many of the same developer kindnesses as C++, while having same-class performance. Learning it has a bit of a curve, but I found that it eventually clicked (I have a C and C++ professional background).
- rwmj 3y agoGiven the vast amount of C/C++ around, much which will never be rewritten, I wonder if bounds checking compilers should be considered?
- afdbcreid 3y agoBounds checking will sure solve some of the problems, but it will not solve all of them, perhaps not even most of them. You'd still got: UAF, iterator invalidation, etc.. And not even all code can be bounds checked, you need to know the length for that (which means using new types such as std::span or having to annotate your functions with a compiler attribute, to be able to also bound-check pointers).
- UncleMeat 3y agoBounds checking is also frustratingly expensive because of C++'s horrible aliasing rules meaning that compilers struggle to soundly eliminate redundant bounds checks.
- amai 3y agoIt will be rewritten by generative ai soon.
- petabyt 3y agoWe've had bound checks and address sanitizers in most C compilers for years now at this point (gcc, tcc, clang)
- rwmj 3y agoI know, I wrote the first one for GCC.
- deleted 3y ago[deleted]
- guh 3y agoThanks but still sticking to C++...
- gosub100 3y agoCan someone explain why we can't double-down on C++ and, through compiler wizardry and reduction in toolset (say, strings can only be fixed-size at 32 chars, 64, or 256 long. No raw pointers, allocator zeroes out all freed memory), achieve a memory-safe language? Obviously, making certain concessions would be a deal-breaker for some, but it might be viable for legacy codebases. If you were to try to make C++ memory-safe, where does it begin to break down?
- afdbcreid 3y agoI don't think you can do that without massive changes to existing codebases, at which point why not just use Rust? There might be a better path for memory-safe language interoperable with C++ (Carbon?) but this will require significant effort.
- ahmedfromtunis 3y agoI think this is, realistically, the easiest way to solve the problem. That, or a totally different language that is (somehow) a drop-in replacement for c/c++. I'm in no way an expert in any aspect that relates to this problem, but it's reasonable to believe that it would be but a mildly challenging task if companies like Google, meta, Microsoft and the likes joined forces. A year of concentrated efforts might be sufficient to rid us with this problem once and for all.
- matthewaveryusa 3y agoI think you would need to go the go/rust route of explicitly calling out unsafe code blocks.
- ruszki 3y agoWhy you need fixed-size strings? Btw I don’t know how this works in most languages, but circular references can be still a problem even with these restrictions. (If I remember well dangling references can be more or less handled, but correct me if I’m wrong. I remember that JavaScript definitely had problem with those)
- gosub100 3y ago
- asylteltine 3y agoAh, they must have found an exploit in Rust then
- greesil 3y agoOr... (puts on tin foil hat) added it themselves. As a C++ programmer, I really want to find a spare week or two to learn Rust.
- stjohnswarts 3y ago*month+
- trealira 3y agoI assume it's because they view private industry as a US asset, and don't want Russia or China hacking them (to steal IP, or gather information, etc.). Promoting cyber security in the civilian workforce is also part of the DoD's 2023 "Cyber Strategy". The Department will take action to foster a culture of cybersecurity and cyber awareness. We will establish an expectation that senior military and civilian leaders possess a baseline fluency in cybersecurity issues. The Department will develop, fund, and implement technical curricula across different levels of professional military and civilian education, emphasizing General Officer and Senior Executive Service leadership courses. https://media.defense.gov/2023/Sep/12/2003299076/-1/-1/1/2023_DOD_Cyber_Strategy_Summary.PDF https://media.defense.gov/2023/Sep/12/2003299076/-1/-1/1/202... They're also trying to promote cyber security in open source software: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3552309/nsa-and-us-agencies-issue-best-practices-for-open-source-software-in-operationa/ https://www.nsa.gov/Press-Room/Press-Releases-Statements/Pre... That's not to say you're wrong about the NSA probably having backdoors in critical software like the Rust compiler.
- phkahler 3y agoWhat is their stance on using C++ with sanitizers? Anyone know?
- steveklabnik 3y agoThe framework they're working with here isn't about specific recommendations like this. It is about non-memory safe languages, mitigations you can try to add safety, and a framework for moving towards memory safe languages over time. It's at a higher level of abstraction than "specific language with specific technique." In the PDF the closest things they talk about to sanitizers are SAST/DAST tooling, which isn't exactly the same thing, and compiler mitigations, which aren't exactly the same thing, but I also don't believe this is intended to be fully comprehensive at this level of detail.
- ahmedfromtunis 3y agoHow about a new drop-in replacement language for c/c++? I'm in no way an expert in any aspect that relates to this problem, but it's reasonable to believe that it would be but a mildly challenging task if companies like Google, meta, Microsoft and the likes joined forces. A year of concentrated efforts might be sufficient to rid us with this problem once and for all. Billions of lines of codes would gain (some) safety instantly.
- sneed_chucker 3y agoThat's basically how Rust is being treated by those companies. But it's not going to be "drop-in", lots of stuff will have to be refactored to work with Rust's memory model. See, memory management is a hard problem and the complexity involved in solving it has to live somewhere. In C and C++, that complexity lives in the programmer's head. In Java, Python, Go, etc. that complexity lives in the program's runtime in the form of garbage collection. In Rust, that complexity lives in the compiler - with some caveats, Rust code is safe as long as it compiles and passes the borrow checker. However, the ownership-based memory model of Rust is not always trivial to port other code to. Modern, idiomatic C++ written with RAII and smart pointers should be relatively easy to port to Rust, but most of the critical systems code out there is not like that at all. Most of the critical systems code out there is written in C or old-style C++ with C-style strings & arrays and raw pointers to heap memory all over the place. So regardless of what your C/C++ language replacement looks like, it will take some serious effort to replace that kind of code.
- steveklabnik 3y agoGoogle, Meta, Microsoft, and the likes are all investing heavily in Rust. You can't do "drop-in replacement" and "memory safety" at the same time.
- lostin 3y agoDo you mean something like Carbon? https://github.com/carbon-language/carbon-lang https://github.com/carbon-language/carbon-lang
- 1970-01-01 3y agoFully agree. The best time to stop giving the next generation of coders the gift of unsafe memory is today. C and C++ should be known as 'legacy' languages.
- butlerm 3y agoIt is generally speaking difficult to make an efficient implementation of the compiler and/or the virtual machine for many memory safe languages without writing it in a more efficient, statically compiled language like C, C++, or Rust. And that is to say nothing of software like operating system kernels and browser engines. So perhaps Rust will gradually take over the world there.
- 1970-01-01 3y agoSimplified, this means it's generally difficult to safely make things go fast. And there's nothing wrong with that. The sooner we realize it the better.
- BaculumMeumEst 3y agoIn the world of graphics programming, you've got: - continuing accumulation of documentation and utility libraries from Khronos - excellent learning materials from the community - tons of legacy code all using C++. https://github.com/KhronosGroup/Vulkan-Utility-Libraries https://github.com/KhronosGroup/Vulkan-Utility-Libraries https://github.com/cg-tuwien/VulkanLaunchpad https://github.com/cg-tuwien/VulkanLaunchpad https://cescg.org/our-services/an-introduction-to-vulkan/ https://cescg.org/our-services/an-introduction-to-vulkan/ Until I see professionals get funding to build, maintain, document, and create training materials for Rust bindings, I'm going to continue to assume there will not be movement in that sector. I don't think industry is going to throw away the C++ ecosystem and build greenfield projects on a foundation of hobby projects.
- natsucks 3y agoimportant comment.
- synergy20 3y agoThe industry did not abandon C and C++ for Ada in the past, likely it will do the same to Rust. Not to mention C and C++ are both evolving and their toolchains are getting much better nowadays. After using Rust for a while, I actually decided to stay with to c/c++ for the rest of my career.
- vlod 3y ago> I actually decided to stay with to c/c++ for the rest of my career. Care to expand?
- nextweek2 3y agoI’m not op of course, but from a career perspective you have to make choices based on what will give you the most opportunities in the future. Right now Rust is technically safer language but it doesn’t have the same amount of job postings and career opportunities as C++. That’s just an inertia problem. The conundrum is if you jump in early and risk the language becoming yet another language or do you wait and see. I haven’t coded C++ in 4 years, but my understanding is that the language is evolving to answer the threat Rust poses to it.
- 0x142857 3y agowelcome to javascript
- guh 3y ago[flagged]
- mikewarot 3y agoMore misdirection away from capability based security. 8( I was hopeful we'd be transitioning by now.... it's at least another decade out.
- ryao 3y agoIt is a shame that there is no open source equivalent to tools like Astree: https://www.absint.com/astree/index.htm https://www.absint.com/astree/index.htm In theory, it is possible to write completely memory safe code in C/C++ using it. As long as its analysis generates no complaints, there are no memory safety issues in the analyzed code.
- deely3 3y agoCan I ask a strawman/obvious question? Does developers of most complex systems use this tool, and if not, then why?
- edwcross 3y agoI beg to differ: there are a few tools which are comparable. Frama-C (https://www.frama-c.com https://www.frama-c.com) is an open source framework that has, among its analyzers, one based on abstract interpretation (https://www.frama-c.com/fc-plugins/eva.html https://www.frama-c.com/fc-plugins/eva.html) that is very similar in spirit to Astree. MOPSA (https://mopsa.lip6.fr https://mopsa.lip6.fr) is another open-source project (albeit more recent, and in a more "academic" stage) that also provides abstract interpretation to analyze C programs for flaws. NASA also released IKOS (https://github.com/NASA-SW-VnV/ikos https://github.com/NASA-SW-VnV/ikos), on the same vein. Of course they lack the polish of a product which costs tens of thousands of euros per license, but they are open source, and their purpose is the same: to ensure code safety via formal methods, in particular abstract interpretation. It is possible to get these tools to analyze some code and generate no complaints, which ensures absence of several kinds of problems, such as memory safety issues. Then again, it's hard to know exactly how much they differ from Astree, since you need a license to compare them, and I don't even know if you are allowed to publish such comparisons.
- jaisjdkaaaej 3y agoI'm not moving languages over memory safety and I'm not going to apologize for it either. I don't particularly like Rust and its not fit to replace C. If it replaces C++ I could care less and may even be somewhat supportive.
- ram_rar 3y agoCan someone with a security background enlighten me, on why Python is on the list of "memory safe" languages? Most of the python code I have worked with is a thin wrapper on C. Wouldnt that make python vulnerable as well?
- steveklabnik 3y agoYou are correct that if you call C from Python, you can run into problems. But the fault there lies with the C, not the Python. Pure Python itself is memory safe. Because memory safety is built on top of memory unsafety, it is generally understood that when discussing things at this sort of level, that we are speaking about the Python-only subset. (Same as any other memory safe language.)
- Coder1996 3y agoI've never thought of security being a reason to use memory-safe languages, but I agree.
- ksec 3y agoAccess Denied You don't have permission to access "http://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3608324/us-and-international-partners-issue-recommendations-to-secure-software-products/ http://www.nsa.gov/Press-Room/Press-Releases-Statements/Pres..." on this server. Judging from the 409 comments right now it seems I am the only one have this problem?