5 ms·
> This article is strawman-ish, because the WH memo doesn’t suggest anything close to “outlawing” C or C++. Maybe not outlaw, but I think in the long term the
by im3w1l 3y ago
> This article is strawman-ish, because the WH memo doesn’t suggest anything close to “outlawing” C or C++.
Maybe not outlaw, but I think in the long term the outcome will be similar. Memory unsafe? No government contract for you! Credit cards details leaked? Well not being memory safe was negligent, no insurance payout for you.
I think eventually all criticial infrastructure (including their dependencies, including libraries but also OS) will be be basically required to be memory safe.
- l33t7332273 3y agoAll OS’s being required to be memory safe would mean some major changes to linux that I just don’t see a path to from today.
- bombcar 3y agoIirc it would affect all current OSes except maybe some experimental/toy ones. Ring 0 may get smaller and smaller but it’s still there.
- secondcoming 3y agoAnd programming becomes a licenced profession!
- marcosdumay 3y ago> Memory unsafe? No government contract for you! That's exactly what the GP pointed that isn't on the memo. But if you insist on using unsafe languages, and not using any of the tools and procedures available for making those safer, then yes, no contract money for you, and no insurance if something happens.
- im3w1l 3y agoIt may not be in the memo, but I do think it's coming, at some point.
- marcosdumay 3y ago"At some point" is an awfully vague phrase. Currently people are making very pragmatic changes that doesn't require an impossible retooling of the entire area. The direction is clearly against carefree software, but nobody seems to be moving any fast on that way. We don't even know if people will hold that direction on the long term. This is not the first pro-security cultural change that happened in computing, and it's not even touching the fact that the computers themselves are not secure.
- kbolino 3y agoA lot of contracting is just developing to spec and/or working directly on-site just like regular employees. The government is going to have to dogfood this approach inasmuch as they want this to work.
- pornel 3y agoThat seems to be exactly the point that even the “not my problem” lowest bidder will have to start paying attention to security, and use a safer language, or hardware mitigations, or sandboxing instead of shipping something that could become a potential backdoor.