Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

thenewstack.io

Post reply on HN
Print view View original

11–20 of 100 posts

Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

#11

Post by UltraSane »

Animats wrote: post #5

“The development of new product lines for use in service of critical infrastructure or [national critical functions] NCFs in a memory-unsafe language (e.g., C or C++) where there are readily available alternative memory-safe languages that could be used is dangerous and significantly elevates risk to national security, national economic security, and national public health and safety.” Now that's a strong statement.…

I shudder to think just how badly the US, Russia, and China have hacked each other by this point.

Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

#12

Post by jerlam »

3eb7988a1663 wrote: post #6

Surely there is going to be an enormous list of exemptions submitted and approved immediately. My quick skim did not make this clear: is this for software only or would hardware appliances also count? Routers, modems, PLCs used in gas centrifuges, etc. are just as attractive for exploitation.

On the other end of the "hardware appliance" spectrum, there is the F-35 Joint Strike Fighter whose software is written mostly in C and C++, heavily networked, and will be part of any future "loyal wingman" drone program. Each plane costs over 80 million US dollars.

Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

#14

Post by johnnyanmac »

gigel82 wrote: post #4

C++ is only "memory-unsafe" if you are hiring bottom of the barrel talent. Likely the same kind of folks for which we had to change car manuals from including schematics and repair instructions to including warnings about not drinking the coolant...

Even if I took your word for it: are you surprised a government would hire as cheaply as possible?

Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

#17

Post by CuriousCosmic »

CoastalCoder wrote: post #10
gigel82 wrote: post #4

C++ is only "memory-unsafe" if you are hiring bottom of the barrel talent. Likely the same kind of folks for which we had to change car manuals from including schematics and repair instructions to including warnings about not drinking the coolant...

I think that argument had more merit back when C++ was a much simpler language. I've been programming in C++ since 1991, and the language / standard library are now so complex that it's hard to be 100% confident that I understand the meaning of any non-trivial code.

I have to massively disagree here. I'm far more confident about code written in the modern style of C++ than I am in old school C++.

Modern C++ with RAII, smart pointers, constexpr, concepts, and heavy instrumentation is so much easier to reason about. It's actually close to Alexander Stepanov's idealised C++.

Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

#18

Post by akira2501 »

I mean.. the last three critical nation wide software failures had nothing to do with memory safety.. but okay. Shouldn't we base recommendations on actual experience?

All the memory safety in the world can't save you from a dumb vendor just screwing millions of computers at once.

Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

#19

Post by omeid2 »

synergy20 wrote: post #15

that means you have to use rust for system level programming then? there is really no other alternative at system programming as far as memory safe is concerned, that uses no GC or VM.

There is a few options, for example Ocaml, Swift, Erlang, and so on.

http://ocamlverse.net/content/systems_programming.html

https://www.swift.org/blog/embedded-swift-examples/

https://www.erlang.org/doc/system/embedded.html

Post reply on HN