Companies goals include backward compatibility, ease of integration with existing hardware blocks (esp GPU’s/AI), raw speed, memory efficiency, and energy use.

Companies goals include backward compatibility, ease of integration with existing hardware blocks (esp GPU’s/AI), raw speed, memory efficiency, and energy use. Most security features either work against these or are perceived to. They also usually cost more in development while slowing it down. If they don’t, you might run into unknowns that risk tanking the whole project. The Snowden leaks showed many big companies were also paid to make their software vulnerable on purpose which CHERI would work against. There’s also motivations. Companies usually don’t care about real security because they’ll be rich anyway. FOSS people are motivated by what they enjoy which is rarely securing the codebase. Relevant to Apple and Google, some companies will ignore good solutions, even permissively licensed, because they’re Not Invented Here. It has to be their way or it won’t happen at all. Any of these might be motivators for Apple not baking in something like CHERI. I agree with you that they’re in the best position. If I was ever hired by them, and able to influence a big decision, baking memory safety into the CPU in a compatibility-preserving way was one of the first decisions I’d have made. It would be a huge differentiator.