5 ms·
Memory Safe Languages: Reducing Vulnerabilities in Modern Software Development [pdf]
- deleted 1y ago[deleted]
- awaymazdacx5 1y agoreducing security incidents for modern software developments
- charcircuit 1y agoA big thing missing is swapping out dependencies in unsafe languages for ones written in safe languages. Usually there are only a couple places that actually deal with user controlled data, so switching to safe dependencies for things like making thumbnails for pdf files can be effective. Edit: One more thing is compiling unsafe code to web assembly or other forms of sandboxing it was not mentioned.
- ethan_smith 1y agoIncremental replacement of critical dependencies also offers a practical migration path for large legacy codebases where complete rewrites are economically infeasible.
- pizlonator 1y agoTwo big problems in this document: - it conflates data race protection with memory safety, and it does so inconsistently. Java and C# are mentioned as MSLs and yet they totally let you race. More fundamentally, data races aren’t the thing that attackers exploit except when those data races do lead to actual memory corruption (like use after free, double free, out of bounds, access to allocator metadata etc). So it’s more precise to not mention data races freedom as a requirement for memory safety, both because otherwise languages like Java and C# don’t meet the definition despite being included in the list and because data races in the presence of memory safety are not a big deal from a security standpoint. - The document fails to mention to mention Fil-C. It would be understandable if it was mentioned with caveats (“new project”, “performance blah blah”) but not mentioning it at all is silly.
- jart 1y ago[flagged]
- jdright 1y agojart putting Carmack and Musk at the same level is a bit sad and revealing, no wonder the downvotes.
- jart 1y agohttps://x.com/ID_AA_Carmack/status/1935353905149341968 https://x.com/ID_AA_Carmack/status/1935353905149341968
- Ygg2 1y ago> Memory safety is like the global warming of the software industry. So it's an insidious long term issue that challenges our systems which reward short term thinking, and will slowly crush us, if we don't do anything about it? I fully agree.
- pornel 1y agoThey're not going to mention a single-person experimental project that has 900 stars on GitHub. This is meant to be a practical strategy that can be implemented nation-wide, without turning into another https://xkcd.com/2347 https://xkcd.com/2347
- pizlonator 1y ago> They're not going to mention a single-person experimental project that has 900 stars on GitHub. Seems like a bad way to pick technology. They do mention things like TRACTOR. Fil-C is far ahead of any project under the TRACTOR umbrella. > This is meant to be a practical strategy that can be implemented nation-wide, without turning into another https://xkcd.com/2347 https://xkcd.com/2347 The solution to that is funding the thing that is essential, rather than complaining that an essential thing is unfunded. DOD could do that
- timewizard 1y ago> MSLs such as Ada, C#, Delphi/Object Pascal, Go, Java, Python, Ruby, Rust, and Swift offer built-in protections against memory safety issues They offer default protections that can be easily overridden in most of those languages. Some of them require you to use those overrides to implement common data structures. > MSLs can prevent entire classes of vulnerabilities, such as buffer overflows, dangling pointers, and numerous other Common Weakness Enumeration (CWE) vulnerabilities. If used a certain way. > Android team made a strategic decision to prioritize MSLs, specifically Rust and Java, for all new development Was that /all/ they did? > Invest initially in training, tools, and refactoring. This investment can usually be offset by long-term savings through reduced downtime, fewer vulnerabilities, and enhanced developer efficiency. That is an exceedingly dubious claim to make in general.
- Animats 1y ago> Out of the 58 in-the-wild zero-days discovered in 2021, 67% were memory safety vulnerabilities. About where that number was twenty years previous. The big difference is that twenty years ago, the enemy was script kiddies. Now it's competent teams funded by multiple nation-states.
- notepad0x90 1y agoIt is also worth mentioning that not all memory safety vulns are exploitable or have a theoretical exploitation vector. Many these days are similar to theoretical crypto vulns in that "some day" the capability might be developed. It isn't just exploit mitigations but secure development practices that make it hard enough to where even theoretical exploitation isn't viable.
- andreidd 1y agoWhy is Delphi/Object Pascal an MSL?
- Ygg2 1y agoWhy shouldn't it be?
- andreidd 1y agoWhat's stopping you from UAF or OOB array access in Delphi?
- Ygg2 1y agoUsually a runtime or compile time check. At least for OOB in Ada. https://www.jdoodle.com/ia/1IgW https://www.jdoodle.com/ia/1IgW
- sirwhinesalot 1y agoDelphi arrays are bounds checked. UAF is mitigated by having ref counted strings and such. Not fully safe but much safer than C and C++.
- cryptonector 1y agoProbably because it has counted byte strings and does bounds checks?
- flohofwoe 1y agoAh, so it looks like the Rust mole in the government survived the DOGE purges, I was wondering what happened to him ;)
- tialaramex 1y agoIt's not that there's some special interest group pushing this particular technology, it's just the best available solution so if you want to solve the problem this is how you do it.
- hitekker 1y agoIIRC, Alex Gaynor was championing Memory Safety & Rust in the FTC. But then he left (or was ejected?) before the Trump Administration came in. I have no clue who is carrying the torch now. Someone probably, given that OP's document references Rust 16 times and Java just 4. But we'll have to see how CISA shakes out after its funding gets cut due to alleged mission creep
- larodi 1y agoSo, Perl with its tainted-data tracking mechanism is not considered safe. Weird.
- johnisgood 1y agoDoes it explicitly say so? I could not find "Perl" in the PDF. There are only examples of MSLs. Perl not making the example list does not mean it is not one. It is a non-exhaustive list.