2025-02-25

Securing tomorrow's software: the need for memory safety standards

Memory safety vulnerabilities have been a persistent security challenge costing billions, prompting a call for industry-wide standardization and secure-by-design practices. Recent advancements in memory-safe languages like Rust and hardware technologies offer promising solutions for widespread adoption. Google advocates for establishing a common framework to assess memory safety assurances and drive industry-wide adoption of secure practices.

Original archive.is archive.ph web.archive.org

Log in to get one-click access to archived versions of this article.

read comments on news aggregators:

Related articles

0.14.0 Release Notes

Zig 0.14.0 introduces major updates including expanded cross-compilation capabilities, improved target support, and incremental compilation features aimed at reducing edit/compile/debug cycle latency, along with significant build system upgrades and language changes.

Effective Rust

A comprehensive guide presenting 35 specific methods to enhance Rust programming practices, covering essential topics from type systems to FFI boundaries. The guide is structured into six main sections, focusing on types, traits, concepts, dependencies, tooling, and advanced Rust features. Each item provides detailed insights for writing more effective and maintainable Rust code.

Smart Pointers Can't Solve Use-After-Free

Smart pointers in C++ cannot fully prevent use-after-free vulnerabilities due to internal raw pointers in types beyond user control. Examples with std::vector, std::span, and std::lock_guard demonstrate how iterator invalidation and pointer mismanagement can still lead to memory safety issues regardless of smart pointer usage.

Banish bots from your Waiting Room and improve wait times for real users

Cloudflare introduces two major Waiting Room enhancements: Turnstile integration to detect and manage bot traffic through an Infinite Queue system, and Session Revocation for optimizing user throughput. These features work together to reduce wait times, protect against automated threats, and ensure fairer access during high-demand events while maintaining a seamless user experience.

Speedrunners = vulnerability researchers

Video game speedrunners unknowingly develop advanced cybersecurity skills through glitch hunting, using professional tools like IDA Pro and Ghidra for reverse engineering. These enthusiasts create sophisticated exploits and technical documentation comparable to professional vulnerability researchers, yet often don't realize their skills could translate into cybersecurity careers.

Abusing C to implement JSON Parsing with Struct Methods

A detailed guide on building a JSON parser in C, focusing on creating a memory-safe implementation with an ergonomic API and struct-attached functions as methods. Key features include comprehensive compiler flags setup, robust memory management, and simplified JSON value representation.

Roger Sollenberger on X: "NEW: A DOGE staffer appears to be posting DOGE work on his public GitHub, as of this week. The staffer, Jordan Wick, also created a repository for a Twitter DM-downloading tool just 3 days ago. He posted work on geospatial data in Jan—undersea cables, ports & “critical minerals.” https://t.co/vtL7PZj6fJ" / X

A Department of Energy (DOGE) employee Jordan Wick has been publicly sharing sensitive work-related code on GitHub, including a Twitter DM downloader and geospatial data analysis tools for undersea cables and critical minerals.

Github scam investigation: Thousands of "mods" and "cracks" stealing your data

A widespread scam operation on GitHub involves thousands of repositories distributing malware disguised as game mods and cracked software. The malware, known as Redox stealer, collects sensitive data including passwords, crypto wallets, and gaming accounts from victims' computers, then sends it to Discord servers for exploitation.

IBM Completes Acquisition of HashiCorp, Creates Comprehensive, End-to-End Hybrid Cloud Platform

IBM has completed its $6.4 billion acquisition of HashiCorp, integrating advanced cloud infrastructure automation and security capabilities into its portfolio. The merger aims to help enterprises manage hybrid cloud environments more efficiently, with HashiCorp's Terraform and Vault products now available through IBM's automation software lineup. The acquisition strengthens IBM's position in multiple growth areas including Red Hat, watsonx, and IT automation.

Distributed Systems Programming Has Stalled

An analysis of distributed systems programming models reveals limitations in current approaches: external-distribution, static-location, and arbitrary-location paradigms. Despite advancements in distributed systems over the last decade, programming models haven't fundamentally improved, leading to ongoing challenges with concurrency, fault tolerance, and versioning.