The US government wants developers to stop using C and C++
CISA and the FBI urge developers to abandon memory-unsafe languages like C and C++ due to security risks, recommending a shift to memory-safe languages by January 1, 2026, despite challenges.
Read original article
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI are urging software developers to abandon "memory-unsafe" programming languages like C and C++. They argue that using these languages poses significant risks to national security, economic stability, and public safety due to vulnerabilities such as buffer overflows. A report highlighted that over half of the analyzed critical open-source projects contain code in memory-unsafe languages, which account for 70% of security vulnerabilities. CISA recommends transitioning to memory-safe languages like Rust, Java, and Python, which offer built-in protections against common memory-related errors. However, the transition is complicated by the extensive time and resources required to convert existing codebases, as well as potential performance trade-offs. Many developers are resistant to learning new languages, especially when they have years of experience with C and C++. CISA has set a deadline for companies to develop roadmaps for this transition by January 1, 2026, but skepticism remains regarding the feasibility of such a shift in the near term, with many businesses prioritizing immediate profits over long-term security investments.
- CISA and FBI are advocating for the abandonment of C and C++ due to security risks.
- Over half of critical open-source projects analyzed use memory-unsafe languages.
- CISA recommends transitioning to memory-safe languages like Rust and Python.
- Transitioning to new languages is resource-intensive and may affect performance.
- Companies must create transition roadmaps by January 1, 2026, but skepticism about compliance exists.
Related
CISA and Partners Guidance for Memory Safety in Critical Open Source Projects
CISA, FBI, and Australian Cyber Security Centre collaborate on memory safety guidance for open source projects. Emphasizes risk understanding, roadmap creation, and collaboration with the open source community for enhanced cybersecurity.
Investing in Rust
Investing in Rust programming language can enhance cybersecurity by preventing memory-related vulnerabilities. Challenges in adoption include integration issues and skill set mismatches, suggesting U.S. policy interventions for promotion.
Safer C++
Alex Gaynor advocates transitioning from C/C++ to memory-safe languages in security-critical contexts, proposing improvements in C++ safety through bounds checking, smart pointers, and a dual strategy for teams.
Safer C++
Alex Gaynor advocates transitioning from C/C++ to memory-safe languages in security-critical contexts, proposing improvements in C++ safety while acknowledging challenges and recommending a dual strategy for enhancement and migration.
The empire of C++ strikes back with Safe C++ blueprint
The Safe C++ Extensions proposal aims to enhance memory safety in C++, responding to demands for secure coding. It introduces compile-time checks and seeks broader industry participation for implementation.
5 comments----
1. https://www.infoworld.com/article/3713203/white-house-urges-...
2. "Torvalds pointed out that there are kernel features that are currently incompatible with Rust; that is impeding Rust support overall."
Related
CISA and Partners Guidance for Memory Safety in Critical Open Source Projects
CISA, FBI, and Australian Cyber Security Centre collaborate on memory safety guidance for open source projects. Emphasizes risk understanding, roadmap creation, and collaboration with the open source community for enhanced cybersecurity.
Investing in Rust
Investing in Rust programming language can enhance cybersecurity by preventing memory-related vulnerabilities. Challenges in adoption include integration issues and skill set mismatches, suggesting U.S. policy interventions for promotion.
Safer C++
Alex Gaynor advocates transitioning from C/C++ to memory-safe languages in security-critical contexts, proposing improvements in C++ safety through bounds checking, smart pointers, and a dual strategy for teams.
Safer C++
Alex Gaynor advocates transitioning from C/C++ to memory-safe languages in security-critical contexts, proposing improvements in C++ safety while acknowledging challenges and recommending a dual strategy for enhancement and migration.
The empire of C++ strikes back with Safe C++ blueprint
The Safe C++ Extensions proposal aims to enhance memory safety in C++, responding to demands for secure coding. It introduces compile-time checks and seeks broader industry participation for implementation.