Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk
1–10 of 100 posts
Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk
#2CISA guidance: https://news.ycombinator.com/item?id=41863640
Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk
#3Just wait five days and this will all go away.
Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk
#4C++ is only "memory-unsafe" if you are hiring bottom of the barrel talent.
Likely the same kind of folks for which we had to change car manuals from including schematics and repair instructions to including warnings about not drinking the coolant...
Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk
#5“The development of new product lines for use in service of critical infrastructure or [national critical functions] NCFs in a memory-unsafe language (e.g., C or C++) where there are readily available alternative memory-safe languages that could be used is dangerous and significantly elevates risk to national security, national economic security, and national public health and safety.”
Now that's a strong statement.
But it's real. There are so many state actors doing cyberattacks now that everything needs to be much tougher. Otherwise, someday soon much of the world stops working.
Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk
#6Surely there is going to be an enormous list of exemptions submitted and approved immediately.
My quick skim did not make this clear: is this for software only or would hardware appliances also count? Routers, modems, PLCs used in gas centrifuges, etc. are just as attractive for exploitation.
Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk
#7C++ is only "memory-unsafe" if you are hiring bottom of the barrel talent. Likely the same kind of folks for which we had to change car manuals from including schematics and repair instructions to including warnings about not drinking the coolant...
Can we please be responsible professionals and move past this. This was settled many years ago.
Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk
#8C++ is only "memory-unsafe" if you are hiring bottom of the barrel talent. Likely the same kind of folks for which we had to change car manuals from including schematics and repair instructions to including warnings about not drinking the coolant...
You must have had incredible luck to never have made a mistake, even ones you didn't realize you made.
Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk
#9Surely there is going to be an enormous list of exemptions submitted and approved immediately. My quick skim did not make this clear: is this for software only or would hardware appliances also count? Routers, modems, PLCs used in gas centrifuges, etc. are just as attractive for exploitation.
I think the really big difference with software is that software is much more likely to be used in unexpected ways where vulnerabilities that weren't important at time of original design end up exposed on the internet for exploitation by everyone.
Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk
#10C++ is only "memory-unsafe" if you are hiring bottom of the barrel talent. Likely the same kind of folks for which we had to change car manuals from including schematics and repair instructions to including warnings about not drinking the coolant...
I think that argument had more merit back when C++ was a much simpler language.
I've been programming in C++ since 1991, and the language / standard library are now so complex that it's hard to be 100% confident that I understand the meaning of any non-trivial code.