Encouraging Adoption of Memory-Safe Languages in Open Source Security Workshop
Explore the challenges and opportunities of promoting memory-safe languages in open-source projects at the OMB/NSF/NIST Workshop. Discuss incentives for developers, critical dependencies, migration strategies, security enhancements, and more.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
DIFFICULTIES AND OPPORTUNITIES OF ENCOURAGING ADOPTION OF MEMORY-SAFE LANGUAGES IN OSS AUG 24-25, 2022: OMB/NSF/NIST WORKSHOP ON OPEN SOURCE SECURITY INITIATIVE
AGENDA 01 03 Brainstorm the various problems we have to solve (20 min) 05 Discuss lessons learned from real world successes and failures (20 min) Meet the Panel (5 min) 02 04 Discuss incentives we can offer to open source developers (20 min) 06 Discuss the scope of the overall problem (10 min) Summarize and wrap-up (15 min)
PANEL MEMBERS PANEL MEMBERS
WELCOME! Abhishek Arya Principal Engineer and Head, Google Open Source Security Team Alex Gaynor Deputy Chief Technologist for Security, Federal Trade Commission David Brumley CEO and Co- Founder, ForAllSecure and Full Professor, Carnegie Mellon University Josh Aas Executive Director and Co-founder, Internet Security Research Group (ISRG) Mathias Payer Associate Professor, cole Polytechnique F d rale de Lausanne (EPFL)
SCOPE OF OVERALL PROBLEM What kind of projects will benefit from this transition ? Which memory safe languages are a critical solution to this problem ? What are the critical dependencies for this work ? E.g. Rust depends on LLVM Are type-unsafe languages like Python, Javascript in scope ?
WHICH PROBLEMS TO SOLVE How to plan migrations to maximize ROI? Riskiest parts, Complexity of new interfaces, Customer disruptions? How to make development easier with multi-language codebases? How can we improve platform support for memory safe languages? OS, Embedded Systems How to avoid security mistakes with mixing unsafe code ? How about adding safety extensions (e.g. CFI, MTE) and annotations(SAL)? What security properties do we want for type unsafe languages ?
INCENTIVES FOR OSS DEVELOPERS How do we get new code written in memory safe languages? How can we get legacy code migrated in parts ? Funding, other incentives? What are the costs of writing new memory-unsafe code? Thoughts? Every N-Thousand lines of code, M CVEs -> $K in Fixes -> $M end-user damage M prod crashes -> $K SRE and SWE fix time
LESSONS LEARNED SO FAR Share your real-world experiences Successes Failures
SUMMARIZE Anything else we missed ?
