Memory Safe Languages in Android 13
security.googleblog.com
Memory Safe Languages in Android 13
1–10 of 606 posts
Re: Memory Safe Languages in Android 13
#2Nice: "it’s likely that using Rust has already prevented hundreds of vulnerabilities from reaching production"
Re: Memory Safe Languages in Android 13
#3From the bottom of the article:
> As Android migrates away from C/C++ to Java/Kotlin/Rust, we expect the number of memory safety vulnerabilities to continue to fall. Here’s to a future where memory corruption bugs on Android are rare!
Re: Memory Safe Languages in Android 13
#4From the bottom of the article: > As Android migrates away from C/C++ to Java/Kotlin/Rust, we expect the number of memory safety vulnerabilities to continue to fall. Here’s to a future where memory corruption bugs on Android are rare!
How about speed from going from C/C++ to Java/Kotlin? Have they considered that even?
Re: Memory Safe Languages in Android 13
#5"Migrating away from C/C++ is challenging, but we’re making progress. Rust use is growing in the Android platform, but that’s not the end of the story.
To meet the goals of improving security, stability, and quality Android-wide, we need to be able to use Rust anywhere in the codebase that native code is required. We’re implementing userspace HALs in Rust. We’re adding support for Rust in Trusted Applications. We’ve migrated VM firmware in the Android Virtualization Framework to Rust.
With support for Rust landing in Linux 6.1 we’re excited to bring memory-safety to the kernel, starting with kernel drivers."
The push for Rust to replace C and C++ continues.
This is confirmation of the NSA recommendation to discontinue using C and C++:
https://media.defense.gov/2022/Nov/10/2003112742/-1/-1/0/CSI...
If you do not know Rust, now is the time to learn:
https://doc.rust-lang.org/book/
Here are some fun holiday-themed exercises to learn with:
I plan on doing Advent of Code in Rust this year.
Re: Memory Safe Languages in Android 13
#6From the bottom of the article: > As Android migrates away from C/C++ to Java/Kotlin/Rust, we expect the number of memory safety vulnerabilities to continue to fall. Here’s to a future where memory corruption bugs on Android are rare!
How about speed from going from C/C++ to Java/Kotlin? Have they considered that even?
I'm assuming that's why they have Rust in the mix there, for where performance is still critical.
Re: Memory Safe Languages in Android 13
#7From the bottom of the article: > As Android migrates away from C/C++ to Java/Kotlin/Rust, we expect the number of memory safety vulnerabilities to continue to fall. Here’s to a future where memory corruption bugs on Android are rare!
How about speed from going from C/C++ to Java/Kotlin? Have they considered that even?
See the section "Safety measures make memory-unsafe languages slow"
Re: Memory Safe Languages in Android 13
#8Glad to see robust work here. This strongly supports what should already be obvious, but sadly is not always understood; that memory safe languages are radically safer than memory unsafe languages. The impact is blatantly demonstrated here.
Re: Memory Safe Languages in Android 13
#9From the bottom of the article: > As Android migrates away from C/C++ to Java/Kotlin/Rust, we expect the number of memory safety vulnerabilities to continue to fall. Here’s to a future where memory corruption bugs on Android are rare!
How about speed from going from C/C++ to Java/Kotlin? Have they considered that even?
It will most likely be C/C++ -> Rust for performance critical modules.
Re: Memory Safe Languages in Android 13
#10"Migrating away from C/C++ is challenging, but we’re making progress. Rust use is growing in the Android platform, but that’s not the end of the story. To meet the goals of improving security, stability, and quality Android-wide, we need to be able to use Rust anywhere in the codebase that native code is required. We’re implementing userspace HALs in Rust. We’re adding support for Rust in Trusted Applications. We’ve…
Actually now is the time to learn C++. Amount of leverage and money C++ developers will be able to utilize is enormous, given how much critical code is written in it.