Live data from Hacker News

The Case for Memory Safe Roadmaps

nsa.gov

121–130 of 427 posts

Re: The Case for Memory Safe Roadmaps

#121
post #32

I advise training programmers instead of throwing them in front of a screen without any training. Companies these days provides no training at all. When I was hired over 40 years ago, I spent plenty of time being trained for my first 3 months. Now, nothing, and you if you want to train a new person, you do it on your own time.

Why train when they just leave the company in a year for 10%+ more money.

Give them a 10% raise if they do well in the first year, problem solved.

Re: The Case for Memory Safe Roadmaps

#122
post #22
post #6

Their "Appendix: Memory Safe Languages" lists: C#, Go, Java, Python, Rust & Swift

Really, the only memory unsafe languages still in use are C and C++. If it weren't for the behemoth of legacy code we'd really have this problem more-or-less licked. Unfortunately, that behemoth is still rampaging across the landscape. "Rewrite it in Rust" gets a bit of pushback, perhaps even justified, but at this point in time I'll take anything that just reduces that behemoth in size. The journey of a thousand mil…

But other languages use c++. I think r for example is widely used and has a ton of packages where people write often buggy c++.

Re: The Case for Memory Safe Roadmaps

#124

Confused about Python in particular considering a lot of powerful and common dependencies in the ecosystem starting out from numpy and friends all have C/++ components to them for performance improvements. Surely this is a vector to be considered?

That's the irony in all of this. The Fort is sprinkling their wisdom down upon the masses and proclaiming that C++ is unsafe while arguing for a language that's a wrapper for c++ developers...Reminds me of John Gall's book about systems "The system itself does not do what it says it is doing."

Re: The Case for Memory Safe Roadmaps

#125
post #99

Earlier quoted context omitted.

If you have no users then go for it. However if you do then you are doing those users a disservice by exposing them to unnecessary risk. Maybe the risk is mitigated in other ways. Your software runs as a cli and not a service. It doesn't process outside input. It is run in an ironclad sandbox. But honestly, if you think the way C++ with RAII want's you to then you should already be following the rules that Rust want'…

so what you’re saying is proper C++ is fine?

What I'm saying is that if you are sufficiently smart then you could concievably write perfectly safe C++. But since almost no one in practice has ever been able to be sufficiently smart consistently enough to ship C or C++ code that doesn't have memory safety issues, I don't trust anyone to do so and would rather people stop writing stuff in them when there are better languages to use where I don't have to trust you as much.

Re: The Case for Memory Safe Roadmaps

#126
post #32

I advise training programmers instead of throwing them in front of a screen without any training. Companies these days provides no training at all. When I was hired over 40 years ago, I spent plenty of time being trained for my first 3 months. Now, nothing, and you if you want to train a new person, you do it on your own time.

No training will prepare a human for writing safe C. It seems to be impossible for a human to do that.

Re: The Case for Memory Safe Roadmaps

#127
post #117
post #6

Their "Appendix: Memory Safe Languages" lists: C#, Go, Java, Python, Rust & Swift

Will we one day be able to use AI to make code memory safe?

Reviewing C/C++ code for memory safety is probably a good use case for LLMs actually. Writing memory safe code from scratch is a much bigger ask.

Re: The Case for Memory Safe Roadmaps

#128
post #6

Their "Appendix: Memory Safe Languages" lists: C#, Go, Java, Python, Rust & Swift

[flagged]

Some software needs to be NSA-certified. If you need a government certification, you get government mandates.

Though at this point, this is a recommendation, not a mandate.

Re: The Case for Memory Safe Roadmaps

#129
post #6

Their "Appendix: Memory Safe Languages" lists: C#, Go, Java, Python, Rust & Swift

Ada people scratching their heads....

It is odd since Ada is DoD's (bastard?) child and NSA is DoD but a little digging you get this from 1997 (with a singular mention of the word "safety"):

https://nap.nationalacademies.org/read/5463/chapter/3

tldr; seems to be that the software development world has changed from the days that DoD was the "dominant" software developer, and Ada in the interim did not get adopted by the commercial sector (with safety critical exceptions in aerospace, etc. noted).

Re: The Case for Memory Safe Roadmaps

#130

Earlier quoted context omitted.

[flagged]

Next thing they'll be giving requirements for people building bridges, houses, and gas and electricity fittings. Seriously, I think the time has long since passed software needs regulating. It's a major part of modern society, and as far as I'm aware, most people aren't opposed to building standards in principle.

They'll "regulate" a bunch of controls to make corporations more efficient at making money, while limiting their liability when they get hacked and increasing the barrier to compete with them.

If we want a safer internet, make them carry insurance against data breaches and fine them a fixed amount, say $1500, for each identity they leak, paid immediately upon proof of pwnage.

Post reply on HN