US Government looking into memory safe programming

US Government looking into memory safe programming

[ajdude]

The US Government is requesting information on adoption of memory safe
programming languages and open-source software security. They’re currently
taking comments until October 9th. I think this is a good opportunity to help
bring Ada back into the spotlight.

https://www.federalregister.gov/documents/2023/08/10/2023-17239/request-for-information-on-open-source-software-security-areas-of-long-term-focus-and-prioritization

AJ

Re: US Government looking into memory safe programming

[Luke A. Guest]

On 24/09/2023 23:28, ajdude wrote:
> The US Government is requesting information on adoption of memory safe
> programming languages and open-source software security. They’re currently
> taking comments until October 9th. I think this is a good opportunity to help
> bring Ada back into the spotlight.
> 
> https://www.federalregister.gov/documents/2023/08/10/2023-17239/request-for-information-on-open-source-software-security-areas-of-long-term-focus-and-prioritization

History is repeating itself. How long before they relax the requirements 
and idiots say "we can use C again, yay!"?

Re: US Government looking into memory safe programming

[Stéphane Rivière]

> History is repeating itself.

+1

> How long before they relax the requirements
> and idiots say "we can use C again, yay!"?

By the time they discover Rust ?

-- 
Stéphane Rivière
Ile d'Oléron - France

Re: US Government looking into memory safe programming

[J-P. Rosen]

Le 25/09/2023 à 11:59, Stéphane Rivière a écrit :
>> How long before they relax the requirements
>> and idiots say "we can use C again, yay!"?
> By the time they discover Rust ?

Or when they realize that there is only one rust compiler, and therefore 
that a single compiler virus could ruin the whole defense system.

-- 
J-P. Rosen
Adalog
2 rue du Docteur Lombard, 92441 Issy-les-Moulineaux CEDEX
https://www.adalog.fr https://www.adacontrol.fr

Re: US Government looking into memory safe programming

[G.B.]

On 25.09.23 12:38, J-P. Rosen wrote:
> Le 25/09/2023 à 11:59, Stéphane Rivière a écrit :
>>> How long before they relax the requirements
>>> and idiots say "we can use C again, yay!"?
>> By the time they discover Rust ?
> 
> Or when they realize that there is only one rust compiler, and therefore that a single compiler virus could ruin the whole defense system.
> 

Maybe, given the emphasis on tools, verification and best
practices, they might consider sub-languages, or profiles,
of several existing languages.

It's not like memory-safety cannot be made available in
languages other than Rust, I should think? Though, it seems
to me that Rust has so much better market-aware development
strategies than any other language since C, outside Microsoft's
or Apple's areas of sales.

Also, I understand that Linux kernel development is
steered towards Rust and LLVM. So, they have decided
not to go back to the 80s, just pick some good bits
and move on, possibly producing grust or crust while
at it.

In order to pick well from Ada and the concepts embodied in it,
imagine what parts of Ada should be thrown out,
ignoring commercial enterprises living off legacy business?
What changes to Ada are a good fit while aiming
at memory safety, verification support,
or light weight and safe parallel execution?

As you can see in [1], there is a suggestion to make money
available to refactoring efforts.

  [1]: https://www.federalregister.gov/d/2023-17239/p-37

Re: US Government looking into memory safe programming

[Luke A. Guest]

On 25/09/2023 16:55, G.B. wrote:

> What changes to Ada are a good fit while aiming
> at memory safety, verification support,
> or light weight and safe parallel execution?

I started thinking about that here https://github.com/Lucretia/orenda.

Re: US Government looking into memory safe programming

[Stéphane Rivière]

> Or when they realize that there is only one rust compiler, and therefore
> that a single compiler virus could ruin the whole defense system.

Good point !

Still some doubts about their ability to reason that far ;)

-- 
Stéphane Rivière
Ile d'Oléron - France

Re: US Government looking into memory safe programming

[Kevin Chadwick]

>> Or when they realize that there is only one rust compiler, and therefore
>> that a single compiler virus could ruin the whole defense system.
>
>Good point !
>
>Still some doubts about their ability to reason that far ;)

Whilst I have in the past refused to use lattice semi conductor hardware due
 to a CDN preventing secure compiler verification, whilst apparently noone
 or few noticed. 

I assume you mean trojaned compiler code inserted upstream to disable
 protections or ignore unsafe code?

Or do you mean utf-8 library code substitution aimed at a particular
 compiler?

-- 
Regards, Kc