Госструктуры бьют тревогу: АНБ и CISA выпустили совместный отчёт, где буквально кричат о переходе на memory-safe языки вроде Rust, Go или Swift. 🚀 Почему? 70% уязвимостей в софте — это classic баги управления памятью (переполнения буфера, use-after-free и прочие страшилки). 💥 Чиновники прямо пишут: хватит мучаться с С/С++, где ошибки — как мины в коде! Вместо ручного разминирования — переходите на языки, которые автоматически следят за памятью. 🛡️ Особенно критично для систем безопасности и инфраструктуры. Хотя Rust уже давно фаворит у разработчиков — теперь это почти госзаказ. 💼 Готовьтесь: скоро контракты могут требовать memory-safe как must-have. Код без null pointer dereference? Да здравствует 🦀 и 🐿️! Максимум защиты — без нервотрёпки.
178226786 story New NSA/CISA Report Again Urges the Use of Memory-Safe Programming Language (theregister.com) 7 Posted by
EditorDavid- on Sunday June 29, 2025 @03:59PM
- from the
- C-you-later
- dept.
- An anonymous reader shared
- this report from the tech news site
- The Register
- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) this week published guidance urging software developers to adopt memory-safe programming languages. «The importance of memory safety cannot be overstated,» the inter-agency report says … The CISA/NSA report revisits the rationale for greater memory safety and the government’s calls to adopt memory-safe languages (MSLs) while also acknowledging the reality that not every agency can change horses mid-stream. «A balanced approach acknowledges that MSLs are not a panacea and that transitioning involves significant challenges, particularly for organizations with large existing codebases or mission-critical systems,» the report says. «However, several benefits, such as increased reliability, reduced attack surface, and decreased long-term costs, make a strong case for MSL adoption.» The report cites how Google by 2024 managed to reduce memory safety vulnerabilities in Android to 24 percent of the total . It goes on to provide an overview of the various benefits of adopting MSLs and discusses adoption challenges. And it urges the tech industry to promote memory safety by, for example, advertising jobs that require MSL expertise. It also cites various government projects to accelerate the transition to MSLs, such as the Defense Advanced Research Projects Agency (DARPA) Translating All C to Rust ( TRACTOR ) program, which aspires to develop an automated method to translate C code to Rust. A recent effort along these lines, dubbed Omniglot , has been proposed by researchers at Princeton, UC Berkeley, and UC San Diego. It provides a safe way for unsafe libraries to communicate with Rust code through a Foreign Function Interface…. «Memory vulnerabilities pose serious risks to national security and critical infrastructure,» the report concludes. «MSLs offer the most comprehensive mitigation against this pervasive and dangerous class of vulnerability.» «Adopting memory-safe languages can accelerate modern software development and enhance security by eliminating these vulnerabilities at their root,» the report concludes, calling the idea «an investment in a secure software future.» «By defining memory safety roadmaps and leading the adoption of best practices, organizations can significantly improve software resilience and help ensure a safer digital landscape.» ← You may like to read: → Blue Origin Just Launched Six More Passengers to the Edge of Space US To Halt Offensive Cyber Operations Against Russia Gen Z Grads Are Being Fired Months After Being Hired Global IT Outage Linked To CrowdStrike Update Disrupts Businesses ‘I Won’t Connect My Dishwasher To Your Stupid Cloud’ Should We Sing the Praises of Agile, or Bury It? This is the most recent story. Help us pick the next by voting on submissions , or submit your own .
