US Government may require open source software to use memory safe languages

[fork-bomber]

https://www.federalregister.gov/documents/2023/08/10/2023-17239/request-for-information-on-open-source-software-security-areas-of-long-term-focus-and-prioritization

[joeatwork]

I’m not seeing “require” in this document. It looks like the document is proposing education and funding for memory safe projects here.

[chiph → joeatwork]

Following the link to the whitehouse.gov cybersecurity policy doc, it looks like this is for Strategic Objective 3.4 - USE FEDERAL GRANTS AND OTHER INCENTIVES TO BUILD IN SECURITY. (pdf warning):

https://www.whitehouse.gov/wp-content/uploads/2023/03/Nation...

And I don't have a problem with this. Years ago the National Security Agency contributed the SELinux kernel module, which improved the security of Linux - not only for Americans, but the entire world. I see this as something that the federal government has identified as a problem and they're asking for input on what to fund. And since it's OSS, everyone benefits.

[api]

Please change this incorrect click bait title.

It’s a project to encourage their use. I have also heard about them being required in the future in government roles that are security sensitive which is quite reasonable.

[lloydatkinson → api]

Bad title then

[LapsangGuzzler]

> As highlighted in the National Cybersecurity Strategy and its Implementation Plan Initiative 4.2.1, the ONCD has established an Open-Source Software Security Initiative (OS3I) to champion the adoption of memory safe programming languages and open-source software security.

This says nothing about "requiring" OSS to use memory safe languages. This headline is misleading.

[mrkeen]

> In 2021, following the aftermath of the Log4Shell vulnerability

> Supporting rewrites of critical open-source software components in memory safe languages

Let's get everyone onto this Java thing I've been hearing so much about.

[jdougan]

While I could see making this a requirement for USG usage, it seems like pretty big overreach outside of that. It would also interfere with the steady supply of 0days the NSA et. al. need.

[Saphyel]

What languages are memory safe? or are they avoiding to say Rust?

[timbit42 → Saphyel]

Ada SPARK: https://en.wikipedia.org/wiki/SPARK_(programming_language)

[valbaca → Saphyel]

Ada

[candiodari]

I'm going to change the license on my products to "You are NOT allowed to use this. Don't ask. Don't use"

It's not like people are suddenly going to respect licenses.

[zgs]

Ha ha ha.

Plenty of OSS is created outside the USA. Good luck applying any such mandates.

[5e92cb50239222b → zgs]

I skimmed through the document and don't see anything about them trying to force anyone to use memory safe languages. Looks more like "let's lead the way with using memory safe languages and good security practices, and think how we can encourage others to follow" which is a pretty good thing IMHO.

[tomohawk]

Let them. The faster they put this in place, the faster they will learn the consequences of their incompetence.

[mschuster91 → tomohawk]

Using memory-safe languages eliminates entire classes of bugs, and this here is where the real money is:

> Supporting rewrites of critical open-source software components in memory safe languages

There is so, so much open-source software in dire need of funding. Actually getting someone to pay for maintenance - even if it is the US government - is a good thing.

Relevant xkcd: https://xkcd.com/2347/

[tomohawk → mschuster91]

That's all we need. A version of sqlite that takes 10x more memory and cpu. And at the same time is incompatible and unusable.

[matt3210]

Rust is memory safe if you chose to use it that way. So is c/c++. Rust has no “defined behavior”, unlike c/c++ which has clear defined behavior (via the standard).

Yes I jump to rust when it’s not mentioned… copium

[tester756 → matt3210]

You can argue endlessly about nuances yet people are being spied on because of mem issues