asane

The US government wants businesses to stop using C and C++, it claims they are unsafe

Online Niel November 12, 2024

US government agencies talk about memory-unsafe languages
C/C++ poses a “risk to national security”, economy, public health and safety
Developers working with critical infrastructure are advised to follow additional guidance

The US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have advised companies against using the popular C and C++ programming languages, citing security concerns.

The joint reporttitled “Product Security Bad Practices,” is part of CISA’s “Secure by Design” initiative and hopes to steer software makers away from risky practices when creating products for critical infrastructure.

The use of memory-unsafe languages such as C and C++ was highlighted as one of the main security threats in the report.

CISA and FBI warn against using C/C++

Described as “dangerous” and a “risk to national security, national economic security, and national public health and safety,” the agencies advise against using memory-unsafe languages when memory-safe languages are a viable alternative.

Other recommended actions include publishing a memory security roadmap by January 1, 2026 detailing steps to address vulnerabilities, particularly for sensitive components, however products with support ending before January 1, 2030 will be exempt from this guide.

More broadly, a Stack Overflow survey of over 3,000 UK developers last month found that nearly two-thirds (63%) of UK developers preferred JavaScript, which is a memory-safe language.

The agencies also highlight some common security oversights, suggesting that companies build products in such a way as to prevent the introduction of SQL injection vulnerabilities and command injection vulnerabilities. The advisory also recommends avoiding default use passwords by requiring the use of secure credentials on installation.

In terms of ongoing support, the two agencies also require companies to issue CVEs “in a timely manner,” particularly for critical and high-impact vulnerabilities, whether discovered internally or by a third party.

Full details of the notice can be found on CISA website.

Association-anemone

Association-anemone

The US government wants businesses to stop using C and C++, it claims they are unsafe

Online Niel

Man wanted for skipping court on assault, burglary charges

Trump says dignitaries use disgusting rhetoric

Rising US consumer confidence is positive for future growth

24-year-old killed over a small dispute

The US government wants businesses to stop using C and C++, it claims they are unsafe

Online Niel

You Might Also Like

Man wanted for skipping court on assault, burglary charges

Trump says dignitaries use disgusting rhetoric

Rising US consumer confidence is positive for future growth

24-year-old killed over a small dispute