Mitigating Memory Safety Issues in Open Source Software
security.googleblog.com
Mitigating Memory Safety Issues in Open Source Software
1–10 of 244 posts
Re: Mitigating Memory Safety Issues in Open Source Software
#2It's buried in there, but it doesn't specifically say Rust:
> That’s why we’re expanding our collaboration with the Internet Security Research Group to support the reimplementation of critical open-source software in memory-safe languages.
Re: Mitigating Memory Safety Issues in Open Source Software
#3What is left out of the title is that they do not provide funding to the current authors/maintainers of these open source projects. Instead, they fund an organization that will rewrite these tools.
Correct me if I’m wrong, but that’s my understanding of the rather terse article.
I would rather have the original maintainers funded and still in control of the many pieces that form the basis of the major Linux distributions.
Re: Mitigating Memory Safety Issues in Open Source Software
#4What is left out of the title is that they do not provide funding to the current authors/maintainers of these open source projects. Instead, they fund an organization that will rewrite these tools. Correct me if I’m wrong, but that’s my understanding of the rather terse article. I would rather have the original maintainers funded and still in control of the many pieces that form the basis of the major Linux distribut…
Yeah, it sounds a lot like Google is going to "hijack" popular open source projects for the sake of "security".
It'll be interesting to watch how this plays out. But I pity the projects where Google's gaze falls upon.
Re: Mitigating Memory Safety Issues in Open Source Software
#5What is left out of the title is that they do not provide funding to the current authors/maintainers of these open source projects. Instead, they fund an organization that will rewrite these tools. Correct me if I’m wrong, but that’s my understanding of the rather terse article. I would rather have the original maintainers funded and still in control of the many pieces that form the basis of the major Linux distribut…
They specifically mention rust based backends for curl where the author of curl was funded to integrate as a starting point. I don't see any mention of funding being exclusively for organisations other than the author(s)?
Re: Mitigating Memory Safety Issues in Open Source Software
#6semi-conspiracy theory: the main goal of this rewriting is to have less and less infrastructure depending on GPL and AGPL-licensed code
Re: Mitigating Memory Safety Issues in Open Source Software
#7What is left out of the title is that they do not provide funding to the current authors/maintainers of these open source projects. Instead, they fund an organization that will rewrite these tools. Correct me if I’m wrong, but that’s my understanding of the rather terse article. I would rather have the original maintainers funded and still in control of the many pieces that form the basis of the major Linux distribut…
Agreed 100%.
Sadly everyone expressing concerns like this will be dismissed and everyone is going to once again hail google for being community friendly and supportive of FOSS.
Re: Mitigating Memory Safety Issues in Open Source Software
#8Can someone please fix the title to the original in the blog ('Mitigating Memory Safety Issues in Open Source Software'), because the current title is not at all representative of what the blog is actually saying.
Re: Mitigating Memory Safety Issues in Open Source Software
#9Would not be cheaper to fix those unsafe languages, such as C, and offer safe mechanisms that could be used upon need?
Why spend thousands, if not millions of dollars, on rewriting existing codebases when they could help fixing the existing toolset and make it safer?
I don't get it.
Re: Mitigating Memory Safety Issues in Open Source Software
#10What is left out of the title is that they do not provide funding to the current authors/maintainers of these open source projects. Instead, they fund an organization that will rewrite these tools. Correct me if I’m wrong, but that’s my understanding of the rather terse article. I would rather have the original maintainers funded and still in control of the many pieces that form the basis of the major Linux distribut…
Yeah, it sounds a lot like Google is going to "hijack" popular open source projects for the sake of "security". It'll be interesting to watch how this plays out. But I pity the projects where Google's gaze falls upon.
I’m not sure “hijack” is the right word. They are using money to entice projects to rewrite in memory safe languages.