Post

To put it another way: if the official position of the Android and Linux kernel teams is “we, some of the world’s best coders, can’t safely use C” then the bar under CRA’s requirements of “safe by design” should be nearly impossible to meet for mere mortals when using C.

Not saying people should use C, but if we were to extend that to what ~every application is deployed on, not to mention faultlore.com/blah/c-isnt-... … that implies it's impossible to meet for anyone.

impossible to meet for anyone _today_ , sure but at the very least we should have governments procurement rules block the spending of taxpayer money on negligent technology choices after some future date e.g. 2050 ? 2060 ? just needs a line in the sand for incentives

I want to ask you and @littledan.dev to duke it out on this one; if I have his view right the CRA doesn't force eg Rust but you also have to have a whole set of mitigations and defences ready to point at in your declaration of conformity

it definitely doesn’t force Rust, but for safety by design of a C-based system, an auditor should absolutely be requiring either (a) “we use Rust to process all untrusted inputs” or (b) a literal phonebook of other mitigations. Which should be a forcing function.

I really want everyone to use memory-safe languages, but for what the CRA requires, we’ll have to see how the phone book of other mitigations works out. Maybe it will be thorough and practical enough, maybe not. It’d be much more inspiring and fun if the CRA didn’t defer to the state of the art!

I think that's the wrong Greg K-H, I'm not sure Kroah-Hartman is on here