Conversation

Notices

1. Embed this notice
   fugueish (fugueish@infosec.exchange)'s status on Thursday, 07-Dec-2023 05:57:57 JST fugueish

   Eliminating this vulnerability class should be seen as a business imperative likely requiring participation from many departments. The authoring agencies urge executives to lead from the top by publicly identifying senior staff who will drive publication of their roadmap and assist with realigning resources as needed.

   https://www.cisa.gov/resources-tools/resources/case-memory-safe-roadmaps

   • Embed this notice
     fugueish (fugueish@infosec.exchange)'s status on Thursday, 07-Dec-2023 05:57:55 JST fugueish

     in reply to

     In part, this is because they are planning for the post-memory-unsafety future. (See e.g. https://www.youtube.com/watch?v=mi6ZLmrXNP0)

     But vendors are still addicted to their ability to dump these externalities onto customers. It's 'expensive' to move away from C/C++ in exposed attack surface — but only because the existing costs are externalized.

   • Embed this notice
     fugueish (fugueish@infosec.exchange)'s status on Thursday, 07-Dec-2023 05:57:57 JST fugueish

     in reply to

     Intelligence agencies begging vendors to fix the bugs they use for intelligence gathering might seem surprising. But they have complex equities to balance, among them the fact that it is their nations who most depend on reliable information infrastructure.

     Matthew Lyon repeated this.