7 ms·

Press Release: Future Software Should Be Memory Safe

146 points by steveklabnik 3y ago

tcdent 3y ago
Programmers writing lines of code do not do so without consequence; the way they do their work is of critical importance to the national interest. Ick.
- consumer451 3y ago
  > Ick. If you don't mind, please explain your aversion.
consumer451 3y ago
Will the Big C lobby stand up against this government tyranny? I for one am very happy to see that this government has the ability to focus on such important and impactful technical details.
- toast0 3y ago
  Big C might have to stop sponsoring Sesame Street, so they have money for lobbying :P
- steveklabnik 3y ago
  I know you're joking, but the government had asked for comments on some of this work previously, and part of the C++ committee did in fact respond. I had read all 200+ responses, and was planning on writing up a post about them, because it is interesting, but I've had other things going on this month, and they actually shipped this before I managed to do so. Oh well, maybe I'll still end up doing this. Anyway, there's a lot of junk in there, but out of major organizations, the vast majority were pro, a few were ambivalent, and the committee's response stuck out as one of the only strongly anti responses. (It was also weird for other reasons that turned out to be a benign misunderstanding.)
  - consumer451 3y ago
    > was planning on writing up a post about them, because it is interesting It is very interesting, and I hope that you still do a write up. > It was also weird for other reasons that turned out to be a benign misunderstanding. I would love to know more about this part, maybe just to understand a bit more about how these bureaucratic things work, which while less technical are also interesting.
    - steveklabnik 3y ago
      > I would love to know more about this part alilleybrinker was the one who got to the bottom of it, so I'll just post his words directly: https://hachyderm.io/@alilleybrinker/111591518571322904 https://hachyderm.io/@alilleybrinker/111591518571322904 The short of it was that it was weirdly evasive around who the authors were, and that ultimately stemmed from a misunderstanding of the form, not from some attempt to hide who they were.
  - trealira 3y ago
    For convenience's sake, these are the links to the RFI and the ISO C++ Direction Group's response: https://www.federalregister.gov/documents/2023/08/10/2023-17239/request-for-information-on-open-source-software-security-areas-of-long-term-focus-and-prioritization https://www.federalregister.gov/documents/2023/08/10/2023-17... https://www.regulations.gov/comment/ONCD-2023-0002-0020 https://www.regulations.gov/comment/ONCD-2023-0002-0020
- nova22033 3y ago
  O say can you C
  - the_panopticon 3y ago
    Yes. The ultimate 'portable assembly language' / Swiss Army knife of systems programmers.
    - deleted 3y ago
      [deleted]
skybrian 3y ago
This doesn’t go into any detail, not even saying what counts as a “memory safe language.” Are there any practical implications? Will the government change anything it does?
- hiddencost 3y ago
  These documents tend to be vague because details could be wrong. They're used by the next layer of bureaucracy to justify programs, and by the next layer to justify plans, and by the next layer to justify designs, and the next layer to justify implementations.
  - shanxxi 3y ago
    [flagged]
- steveklabnik 3y ago
  So, this alludes to "The Case for Memory Safe Roadmaps", discussed on HN here https://news.ycombinator.com/item?id=38611175 https://news.ycombinator.com/item?id=38611175 This document also does not provide a concrete definition of "memory safe language," instead only providing examples of such, but there are two things that are interesting about it: first of all, it provides C and C++ as examples of "memory unsafe languages," explicitly. The second is more towards your "practical implications" question. It says this: > With this guidance, the authoring agencies urge senior executives at every software manufacturer to reduce customer risk by prioritizing design and development practices that implement MSLs. Additionally, the agencies urge software manufacturers to create and publish memory safe roadmaps that detail how they will eliminate memory safety vulnerabilities in their products. By publishing memory safe roadmaps, manufacturers will signal to customers that they are taking ownership of security outcomes, embracing radical transparency, and taking a top-down approach to developing secure products—key Secure by Design tenets. The National Defense Authorization Act for Fiscal Year 2024 had language inside of it that said: > SEC. 1713. POLICY AND GUIDANCE ON MEMORY-SAFE SOFT- WARE PROGRAMMING. > > (a) POLICY AND GUIDANCE.—Not later than 270 days after the date of the enactment of this Act, the Secretary of Defense shall develop a Department of Defense wide policy and guidance in the form of a directive memorandum to implement the recommendations of the National Security Agency contained in the Software Memory Safety Cybersecurity Information Sheet published by the Agency in November, 2022, regarding memory-safe software programming languages and testing to identify memory-related vulnerabilities in software developed, acquired by, and used by the Department of Defense." This is referring to the above. However, the final bill text seems to be missing this, and I haven't tracked down yet how that happened. The sentiment seems to feel like this is something akin to a softer version of the Ada Mandate: that being implemented in a memory safe language is a competitive advantage if you want to sell to the DoD, because using memory unsafe languages will require documentation explaining how you're mitigating the issues they have. Time will tell if that actually comes to pass.
dboreham 3y ago
The government mandated IPv6 around 2004.
- wakawaka28 3y ago
  Didn't they also mandate Ada at one point?
  - steveklabnik 3y ago
    That was inside the DoD itself, yes.
  - timbit42 3y ago
    In 1975, the DoD commissioned Ada to be designed and built. Although the use of Ada wasn't mandated until 1991, between 1983 and 1996 the number of high level programming languages in use at the DoD fell from 450 to 37. For a few years in the mid-80's, Ada was the most popular programming language, even temporarily surpassing C and C++. The mandate was removed in 1997. Ada was required for NATO systems and was mandated as the preferred language for defense-related software in Sweden, Germany, and Canada. Today it is used in projects where a bug can have severe consequences such as avionics, air-traffic control, and commercial rockets such as the Ariane 4 and 5, satellites and other space systems, railway transport, and banking.
_mlbt 3y ago
I know rewrite it in Rust has essentially become a meme at this point, but really there aren't a lot of great reasons to write new software in languages that aren't memory safe. The only compelling reasons I can think of off the top of my head are interop with existing software and that C and C++ developers would require a bit of training to move to safer languages. There may also be a few problem domains that demand the maximum performance and lowest resource utilization possible, but your typical software would have more than acceptable performance in a memory safe language.
- throwawaymaths 3y ago
  what does this even mean. I guess in the future you will not be allowed to use any rust that uses unsafe()?
  - digging 3y ago
    Are you asking what does (the comment you're replying to) mean, or what does (TFA) mean? > not be allowed to use any rust that uses unsafe() Not allowed by whom? What's made you assume your computer will be policed for non-memory-safe code?
  - _mlbt 3y ago
    No one is saying that you can't use unsafe languages or features when you need to. This press release is announcing the release of a report from the White House Office of the National Cyber Director (ONCD) and it is simply a recommendation, not law or regulatory guidance.
    - generalizations 3y ago
      TBH it'd be pretty hilarious if they actually tried to restrict the use of unsafe languages.
      - wolverine876 3y ago
        Other fields are restricted from using unsafe materials and materials, and are required to demonstrate safety. I think IT still has it's head in the space of an immature industry of hackers. IMHO, at least for many things, such as IT systems controlling fundamental public functions (e.g., DNS), services (e.g., electrical grid), dangerous machines, etc., our engineering should be held the same standards as bridges, airplanes, etc. Look at the endless problems and costs caused by our crappy quality: National security harms and risk, privacy violations, endless fraud, systems that are almost impossible to adequately secure.
mikewarot 3y ago
Meanwhile, most people haven't even heard of Capability Based Security.[1] 8( It's sad to see so much effort wasted, while ignoring the root cause, ambient authority. Given the sad state of operating systems these days, you're forced to absolutely trust any code you run, which is nuts. Anything you run can open a port to a server somewhere and exfiltrate all your data, encrypt it, or whatever evil that the programmer wants, and there's no practical way to stop it. --- Imagine if the power grid were built without any fuses or circuit breakers... that's what our internet and computers are like at present, in terms of security. In that world, it would be like the White House demanding purer copper in the wiring. [1] https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security
- candiddevmike 3y ago
  Capability security doesn't prevent data leakage and lateral movement, especially in today's age of "identity based security". A compromised application would most likely still be running with a privileged identity, giving it access to databases etc.
  - mikewarot 3y ago
    There is no such thing as "privileged identity" in a capabilities based operating system. When you open a document, the application ONLY gets a handle to that document, and nothing else. It certainly can't just then open a pipe to a server somewhere and dump all your documents to it, unlike any random program these days.
    - JohnMakin 3y ago
      You've never heard of the confused deputy problem? Yes in your perfect world that shouldn't be possible. However, the real world is complicated.
      - mikewarot 3y ago
        Yes, I have.... quoting Wikipedia[1] From Wikipedia, the free encyclopedia In information security, a confused deputy is a computer program that is tricked by another program (with fewer privileges or less rights) into misusing its authority on the system. It is a specific type of privilege escalation.[] The confused deputy problem is often cited as an example of why capability-based security is important. Capability systems protect against the confused deputy problem, whereas access-control list–based systems do not.[] [1] https://en.wikipedia.org/wiki/Confused_deputy_problem https://en.wikipedia.org/wiki/Confused_deputy_problem
bun_terminator 3y ago
this will be massive ammunition for the anti-cpp crowd. "C and C++" smh
deleted 3y ago
[deleted]
Decabytes 3y ago
What I'm most curious about is how this will affect new program language development, and programming languages currently in development. Like if Zig wants to see mainstream adoption, will it have to implement the Borrow Checker, or something similar, if people want to use Zig in government contexts? Trying to create a new programming language that people will invest in is hard enough, and if it isn't memory safe, it will be even less attractive to people. On top of that, trying to start a software business is tough, and if your will be shunned if your stack is non memory safe, why put yourself at a disadvantage?
- slimsag 3y ago
  The report says "there are dozens of memory safe programming languages that can – and should – be used". The DoD, NSA, and CISA say[0] memory safe languages include[0]: * C# * Go * Java * Python * Rust * Swift Presumably any other language that can run on a virtual machine, like WASM, is also to be included! Exciting days ahead :) [0] https://media.defense.gov/2023/Dec/06/2003352724/-1/-1/0/THE-CASE-FOR-MEMORY-SAFE-ROADMAPS-TLP-CLEAR.PDF https://media.defense.gov/2023/Dec/06/2003352724/-1/-1/0/THE...
  - trealira 3y ago
    > Presumably any other language that can run on a virtual machine, like WASM, is also to be included! Exciting days ahead :) C can be compiled to WASM, and it's not a memory safe language, so this can't be true...
  - deleted 3y ago
    [deleted]
brosciencecode 3y ago
In other news: crimes should not be committed, and car accidents are outlawed
- steveklabnik 3y ago
  This is more like "seat belts make car accidents safer for passengers, and so we should move towards using them where possible."
  - brosciencecode 3y ago
    We’re working under the assumption that “memory safe languages” can’t be unsafe themselves, which isn’t the case.
    - steveklabnik 3y ago
      Seat belts are also not an absolute ward against death in an accident.

146 points by steveklabnik 3y ago

Programmers writing lines of code do not do so without consequence; the way they do their work is of critical importance to the national interest. Ick.

consumer451 3y ago
> Ick. If you don't mind, please explain your aversion.

consumer451 3y ago

Will the Big C lobby stand up against this government tyranny? I for one am very happy to see that this government has the ability to focus on such important and impactful technical details.

toast0 3y ago
Big C might have to stop sponsoring Sesame Street, so they have money for lobbying :P
steveklabnik 3y ago
I know you're joking, but the government had asked for comments on some of this work previously, and part of the C++ committee did in fact respond. I had read all 200+ responses, and was planning on writing up a post about them, because it is interesting, but I've had other things going on this month, and they actually shipped this before I managed to do so. Oh well, maybe I'll still end up doing this. Anyway, there's a lot of junk in there, but out of major organizations, the vast majority were pro, a few were ambivalent, and the committee's response stuck out as one of the only strongly anti responses. (It was also weird for other reasons that turned out to be a benign misunderstanding.)
- consumer451 3y ago
  > was planning on writing up a post about them, because it is interesting It is very interesting, and I hope that you still do a write up. > It was also weird for other reasons that turned out to be a benign misunderstanding. I would love to know more about this part, maybe just to understand a bit more about how these bureaucratic things work, which while less technical are also interesting.
  - steveklabnik 3y ago
    > I would love to know more about this part alilleybrinker was the one who got to the bottom of it, so I'll just post his words directly: https://hachyderm.io/@alilleybrinker/111591518571322904 https://hachyderm.io/@alilleybrinker/111591518571322904 The short of it was that it was weirdly evasive around who the authors were, and that ultimately stemmed from a misunderstanding of the form, not from some attempt to hide who they were.
- trealira 3y ago
  For convenience's sake, these are the links to the RFI and the ISO C++ Direction Group's response: https://www.federalregister.gov/documents/2023/08/10/2023-17239/request-for-information-on-open-source-software-security-areas-of-long-term-focus-and-prioritization https://www.federalregister.gov/documents/2023/08/10/2023-17... https://www.regulations.gov/comment/ONCD-2023-0002-0020 https://www.regulations.gov/comment/ONCD-2023-0002-0020
nova22033 3y ago
O say can you C
- the_panopticon 3y ago
  Yes. The ultimate 'portable assembly language' / Swiss Army knife of systems programmers.
  - deleted 3y ago
    [deleted]

skybrian 3y ago

This doesn’t go into any detail, not even saying what counts as a “memory safe language.” Are there any practical implications? Will the government change anything it does?

hiddencost 3y ago
These documents tend to be vague because details could be wrong. They're used by the next layer of bureaucracy to justify programs, and by the next layer to justify plans, and by the next layer to justify designs, and the next layer to justify implementations.
- shanxxi 3y ago
  [flagged]
steveklabnik 3y ago
So, this alludes to "The Case for Memory Safe Roadmaps", discussed on HN here https://news.ycombinator.com/item?id=38611175 https://news.ycombinator.com/item?id=38611175 This document also does not provide a concrete definition of "memory safe language," instead only providing examples of such, but there are two things that are interesting about it: first of all, it provides C and C++ as examples of "memory unsafe languages," explicitly. The second is more towards your "practical implications" question. It says this: > With this guidance, the authoring agencies urge senior executives at every software manufacturer to reduce customer risk by prioritizing design and development practices that implement MSLs. Additionally, the agencies urge software manufacturers to create and publish memory safe roadmaps that detail how they will eliminate memory safety vulnerabilities in their products. By publishing memory safe roadmaps, manufacturers will signal to customers that they are taking ownership of security outcomes, embracing radical transparency, and taking a top-down approach to developing secure products—key Secure by Design tenets. The National Defense Authorization Act for Fiscal Year 2024 had language inside of it that said: > SEC. 1713. POLICY AND GUIDANCE ON MEMORY-SAFE SOFT- WARE PROGRAMMING. > > (a) POLICY AND GUIDANCE.—Not later than 270 days after the date of the enactment of this Act, the Secretary of Defense shall develop a Department of Defense wide policy and guidance in the form of a directive memorandum to implement the recommendations of the National Security Agency contained in the Software Memory Safety Cybersecurity Information Sheet published by the Agency in November, 2022, regarding memory-safe software programming languages and testing to identify memory-related vulnerabilities in software developed, acquired by, and used by the Department of Defense." This is referring to the above. However, the final bill text seems to be missing this, and I haven't tracked down yet how that happened. The sentiment seems to feel like this is something akin to a softer version of the Ada Mandate: that being implemented in a memory safe language is a competitive advantage if you want to sell to the DoD, because using memory unsafe languages will require documentation explaining how you're mitigating the issues they have. Time will tell if that actually comes to pass.

dboreham 3y ago

The government mandated IPv6 around 2004.

wakawaka28 3y ago
Didn't they also mandate Ada at one point?
- steveklabnik 3y ago
  That was inside the DoD itself, yes.
- timbit42 3y ago
  In 1975, the DoD commissioned Ada to be designed and built. Although the use of Ada wasn't mandated until 1991, between 1983 and 1996 the number of high level programming languages in use at the DoD fell from 450 to 37. For a few years in the mid-80's, Ada was the most popular programming language, even temporarily surpassing C and C++. The mandate was removed in 1997. Ada was required for NATO systems and was mandated as the preferred language for defense-related software in Sweden, Germany, and Canada. Today it is used in projects where a bug can have severe consequences such as avionics, air-traffic control, and commercial rockets such as the Ariane 4 and 5, satellites and other space systems, railway transport, and banking.

_mlbt 3y ago

I know rewrite it in Rust has essentially become a meme at this point, but really there aren't a lot of great reasons to write new software in languages that aren't memory safe. The only compelling reasons I can think of off the top of my head are interop with existing software and that C and C++ developers would require a bit of training to move to safer languages. There may also be a few problem domains that demand the maximum performance and lowest resource utilization possible, but your typical software would have more than acceptable performance in a memory safe language.

throwawaymaths 3y ago
what does this even mean. I guess in the future you will not be allowed to use any rust that uses unsafe()?
- digging 3y ago
  Are you asking what does (the comment you're replying to) mean, or what does (TFA) mean? > not be allowed to use any rust that uses unsafe() Not allowed by whom? What's made you assume your computer will be policed for non-memory-safe code?
- _mlbt 3y ago
  No one is saying that you can't use unsafe languages or features when you need to. This press release is announcing the release of a report from the White House Office of the National Cyber Director (ONCD) and it is simply a recommendation, not law or regulatory guidance.
  - generalizations 3y ago
    TBH it'd be pretty hilarious if they actually tried to restrict the use of unsafe languages.
    - wolverine876 3y ago
      Other fields are restricted from using unsafe materials and materials, and are required to demonstrate safety. I think IT still has it's head in the space of an immature industry of hackers. IMHO, at least for many things, such as IT systems controlling fundamental public functions (e.g., DNS), services (e.g., electrical grid), dangerous machines, etc., our engineering should be held the same standards as bridges, airplanes, etc. Look at the endless problems and costs caused by our crappy quality: National security harms and risk, privacy violations, endless fraud, systems that are almost impossible to adequately secure.

mikewarot 3y ago

Meanwhile, most people haven't even heard of Capability Based Security.[1] 8( It's sad to see so much effort wasted, while ignoring the root cause, ambient authority. Given the sad state of operating systems these days, you're forced to absolutely trust any code you run, which is nuts. Anything you run can open a port to a server somewhere and exfiltrate all your data, encrypt it, or whatever evil that the programmer wants, and there's no practical way to stop it. --- Imagine if the power grid were built without any fuses or circuit breakers... that's what our internet and computers are like at present, in terms of security. In that world, it would be like the White House demanding purer copper in the wiring. [1] https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security

candiddevmike 3y ago
Capability security doesn't prevent data leakage and lateral movement, especially in today's age of "identity based security". A compromised application would most likely still be running with a privileged identity, giving it access to databases etc.
- mikewarot 3y ago
  There is no such thing as "privileged identity" in a capabilities based operating system. When you open a document, the application ONLY gets a handle to that document, and nothing else. It certainly can't just then open a pipe to a server somewhere and dump all your documents to it, unlike any random program these days.
  - JohnMakin 3y ago
    You've never heard of the confused deputy problem? Yes in your perfect world that shouldn't be possible. However, the real world is complicated.
    - mikewarot 3y ago
      Yes, I have.... quoting Wikipedia[1] From Wikipedia, the free encyclopedia In information security, a confused deputy is a computer program that is tricked by another program (with fewer privileges or less rights) into misusing its authority on the system. It is a specific type of privilege escalation.[] The confused deputy problem is often cited as an example of why capability-based security is important. Capability systems protect against the confused deputy problem, whereas access-control list–based systems do not.[] [1] https://en.wikipedia.org/wiki/Confused_deputy_problem https://en.wikipedia.org/wiki/Confused_deputy_problem

bun_terminator 3y ago

this will be massive ammunition for the anti-cpp crowd. "C and C++" smh

deleted 3y ago

[deleted]

Decabytes 3y ago

What I'm most curious about is how this will affect new program language development, and programming languages currently in development. Like if Zig wants to see mainstream adoption, will it have to implement the Borrow Checker, or something similar, if people want to use Zig in government contexts? Trying to create a new programming language that people will invest in is hard enough, and if it isn't memory safe, it will be even less attractive to people. On top of that, trying to start a software business is tough, and if your will be shunned if your stack is non memory safe, why put yourself at a disadvantage?

slimsag 3y ago
The report says "there are dozens of memory safe programming languages that can – and should – be used". The DoD, NSA, and CISA say[0] memory safe languages include[0]: * C# * Go * Java * Python * Rust * Swift Presumably any other language that can run on a virtual machine, like WASM, is also to be included! Exciting days ahead :) [0] https://media.defense.gov/2023/Dec/06/2003352724/-1/-1/0/THE-CASE-FOR-MEMORY-SAFE-ROADMAPS-TLP-CLEAR.PDF https://media.defense.gov/2023/Dec/06/2003352724/-1/-1/0/THE...
- trealira 3y ago
  > Presumably any other language that can run on a virtual machine, like WASM, is also to be included! Exciting days ahead :) C can be compiled to WASM, and it's not a memory safe language, so this can't be true...
- deleted 3y ago
  [deleted]

brosciencecode 3y ago

In other news: crimes should not be committed, and car accidents are outlawed

steveklabnik 3y ago
This is more like "seat belts make car accidents safer for passengers, and so we should move towards using them where possible."
- brosciencecode 3y ago
  We’re working under the assumption that “memory safe languages” can’t be unsafe themselves, which isn’t the case.
  - steveklabnik 3y ago
    Seat belts are also not an absolute ward against death in an accident.