US government wants devs to stop using C and C++

The US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI are urging software developers to move away from using "memory-unsafe" programming languages like C and C++. They emphasize that these languages pose significant risks to national security, economic stability, and public safety due to vulnerabilities such as buffer overflows. A report highlighted that over half of the analyzed critical open-source projects contain code in memory-unsafe languages, which account for 70% of security vulnerabilities. CISA recommends transitioning to memory-safe languages like Rust, Java, and Python, which offer built-in protections against common memory-related errors. However, the transition is complicated by the extensive time and resources required to convert existing codebases, as well as potential performance issues associated with newer languages. CISA has set a deadline for companies to develop roadmaps for this transition by January 1, 2026, arguing that the long-term benefits outweigh the initial costs. Despite these recommendations, many developers and companies are resistant to change, prioritizing speed and existing expertise in C and C++. The article suggests that while a shift to memory-safe languages is a good idea, it is unlikely to happen quickly, with significant resistance expected in the near term.

- CISA and FBI are advocating for a shift from C and C++ to memory-safe languages.

- Memory safety vulnerabilities account for 70% of security issues in software.

- Transitioning to new languages is resource-intensive and may affect performance.

- Companies must create transition roadmaps by January 1, 2026.

- Resistance to change is prevalent among developers and organizations.