Secure by DesignMemory Safety
Front
Memory safety defects like buffer overflows and use-after-free account for most security defects in C and C++ code.
These defects are not primarily a developer skill problem. They are a language and tooling problem. Memory-safe languages like Rust, Java, and Python eliminate this entire class by construction.
Android reports 1000x lower memory safety defect density in Rust than in its C and C++ code, with fewer rollbacks and less review time. Manufacturers can show commitment by publishing a memory safety roadmap.
Back
Discussion prompts
- What percentage of your codebase is written in memory-safe languages?
- How would you characterize memory safety defects in your products? What patterns do you notice?
- What would a roadmap to eliminate memory-unsafe code look like for your team?