Herb Sutter, an expert in C++, discusses the urgent need to address memory safety vulnerabilities highlighted in a recent US government report. The podcast delves into the importance of prioritizing software security, enhancing C++ safety, and countering cybersecurity threats from criminal organizations and nation states. Sutter emphasizes the evolution of the C++ language through standards committees and working groups, focusing on accessible safety measures in programming development.
Proactive reduction of software attack surface urged due to memory safety vulnerabilities highlighted in infamous cyber events.
C++ aims to enhance memory safety without compromising performance, utilizing tools and exploring safety profiles for different domains.
Emphasis on collaboration to address software vulnerabilities comprehensively by leveraging available tools and promoting safety standards.
Deep dives
Focus on Memory Safety Vulnerabilities in Software Infrastructure
The episode discusses the US government's report urging the technical community to reduce the attack surface area of software infrastructure by highlighting memory safety vulnerabilities. Examples like the Morris worm of 1988, Harp bleed vulnerability in 2014, and blast pass exploit of 2023 are mentioned. Herb Sutter, working at Microsoft and chairing the ISO C++ Standards Committee, addresses the importance of memory safety in the context of recent cyberattacks and the evolving software landscape.
Challenges in Making C++ a Memory-Safe Language
The conversation delves into the challenges of making C++ a memory-safe language. Despite its focus on performance and control, C++ trusts programmers while providing tools for memory safety. The discussion emphasizes the need to balance performance with safety, highlighting efforts to enhance memory safety by default in C++ without compromising backward compatibility.
Role of Profiles in Enhancing C++ Safety Measures
The episode introduces profiles as a mechanism to label safety rules in C++ for enhanced memory safety. It explains how profiles can offer varying subsets of safety rules to cater to different domains. The Standards Committee is exploring the implementation of profiles to allow developers to opt into specific safety measures by default, akin to existing practices in memory-safe languages like Rust and C#.
Call to Industry Collaboration for Software Security
The podcast emphasizes the importance of collaboration among tech companies, government agencies, and programming communities to address software vulnerabilities comprehensively. The call to action includes using available tools like sanitizers and fuzzers, highlighting the need to prioritize top vulnerabilities, including memory safety concerns in C++ and broader security issues across programming languages and domains.
Overcoming Software Vulnerabilities Through Industry Partnerships
The conversation extends to potential collaborations between the C++ Standards Committee, industry bodies, and government agencies to tackle software vulnerabilities collectively. Efforts are noted in responding to government inquiries and promoting safety standards like those from MISRA focused on life safety. The episode concludes with a call to action for collaborative engagement to strengthen software security measures.
The U.S. government recently released a report calling on the technical community to proactively reduce the attack surface area of software infrastructure. The report emphasized memory safety vulnerabilities, which affect how memory can be accessed, written, allocated, or deallocated.
The report cites this class of vulnerability as a common theme in the some of the most infamous cyber events, such as the Morris worm of 1988, the Heartbleed vulnerability in 2014, and the Blastpass exploit of 2023.
Herb Sutter works at Microsoft and chairs the ISO C++ standards committee. He joins the show to talk about C++ safety.
Jordi Mon Companys is a product manager and marketer that specializes in software delivery, developer experience, cloud native and open source. He has developed his career at companies like GitLab, Weaveworks, Harness and other platform and devtool providers. His interests range from software supply chain security to open source innovation. You can reach out to him on Twitter at @jordimonpmm.