US White House: The responsibility of cybersecurity should be tech companies' and the Federal government's, not the individual

Of all the things I expected to read in my morning feed of tech news, a report from the US White House stating that tech companies and governments need to stop using certain programming languages to combat cybercrime wasn't top of my list. But that's exactly what has happened and the document in question, Back to the Building Blocks, lays out the changes required and the reasons behind them.

The first thing that needs to go, according to the report, is the use of memory-unsafe programming languages to create the applications and codebases on which large-scale critical systems are reliant. Languages such as C and C++ are classed as being memory-unsafe as they have no automatic system to manage the use of memory; instead, it's down to the programmers themselves to prevent problems such as buffer overflows, either by checking the code directly or by using additional applications.

Agencies such as the NSA, CISA, and FBI recommend that the likes of C#, Python, and Rust should be used, as these are all deemed memory-safe. Rewriting every piece of critical software is a monumental task and the report suggests that even just reworking a handful of small libraries will help. At the very least, all new applications should be developed using a memory-safe language.

And it's not just about software, as choosing the right hardware matters a lot, too. Pick any one of the latest processors from AMD, Intel, Nvidia, or Qualcomm and you'll see that they're packed with all kinds of features to improve their memory security. One such example is the memory tagging extension that checks to see if the correct memory locations are being addressed in the code. There's a performance impact to using it, of course, but this is true of all such measures.

The report goes on to state that developers should rely on so-called formal methods, which are mathematical techniques for designing, writing, and testing code, acting as a reliable means to ensure that applications are as robust as possible.

I