Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

thenewstack.io

Post reply on HN
Print view View original

21–30 of 100 posts

Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

#21

Post by andrewflnr »

johnnyanmac wrote: post #14
gigel82 wrote: post #4

C++ is only "memory-unsafe" if you are hiring bottom of the barrel talent. Likely the same kind of folks for which we had to change car manuals from including schematics and repair instructions to including warnings about not drinking the coolant...

Even if I took your word for it: are you surprised a government would hire as cheaply as possible?

Having worked in government: Well, yes. Defense contractors aren't cheap, and they could probably hire cheaper talent if they were motivated/willing to clear away some red tape. That said, not everyone at a defense contractor is exactly top talent.

Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

#22

Post by mu53 »

UltraSane wrote: post #13
lisper wrote: post #3

Just wait five days and this will all go away.

Nope, the US government seems to be deadly serious about this, and with good reason. Software security is a absolutely a critical national security issue at this point.

You can't just hand wave the entirety of the C/C++ ecosystem away.

There is no second option for many applications or hardware

Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

#24

Post by candiddevmike »

synergy20 wrote: post #15

that means you have to use rust for system level programming then? there is really no other alternative at system programming as far as memory safe is concerned, that uses no GC or VM.

GC or VM may be perfectly fine for system level programming. Microsoft's project singularity had everything including the kernel using GC iirc

Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

#26

Post by Jtsummers »

overstay8930 wrote: post #23
lisper wrote: post #3

Just wait five days and this will all go away.

Both admins want this to happen, one will just grant more exemptions than the other.

DOD mandated that all systems be written in Ada, that lasted about 5 minutes. DOD also fails to properly fund programs and properly manage them so there are critical systems literally still depending on DOS.

Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

#27

Post by danparsonson »

adgjlsfhk1 wrote: post #9
3eb7988a1663 wrote: post #6

Surely there is going to be an enormous list of exemptions submitted and approved immediately. My quick skim did not make this clear: is this for software only or would hardware appliances also count? Routers, modems, PLCs used in gas centrifuges, etc. are just as attractive for exploitation.

I think the really big difference with software is that software is much more likely to be used in unexpected ways where vulnerabilities that weren't important at time of original design end up exposed on the internet for exploitation by everyone.

Why does that not apply to router firmware for example? The primary role of a domestic router is to be exposed to the internet.

Re: Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk

#30

Post by est31 »

sidewndr46 wrote: post #20

How would any software be FIPS compliant? Is there a "memory-safe" implementation of TLS that is also FIPS certified?

rustls together with aws-lc-rs (and its FIPS mode) can do FIPS-compatible cryptography together with memory-safe TLS processing around it. The FIPS-compatible cryptography is provided in C, but low-level crypto routines is usually not where memory safety issues hide.

https://www.memorysafety.org/blog/rustls-with-aws-crypto-bac...

Post reply on HN