US government warns key open source programs aren’t sufficiently protected
Linux and Chromium both criticized by CISA
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
In a joint report by the FBI, the US Cybersecurity and Infrastructure Security Agency (CISA) and its Canadian and Australian counterparts, experts have warned manyopen sourceprograms lack sufficient protection against emerging and evolving threat actors.
In its analysis of 172 open source projects, the CISA highlighted the importance of using memory-safe languages in preventing many vulnerabilities.
Thereportclaims only half (52%) of the projects contained code written in a memory-unsafe language.
US government highlights the importance of memory-safe languages
Memory safety is crucial in preventing common vulnerabilities like buffer overflows and use-after-free errors. Popular coding languages like Rust, Java, Goland, C# and Python are designed to manage memory automatically, reducing the likelihood of these vulnerabilities.
However, other popular languages like C, C++ and Assembly require manual memory management, which opens up the doors to potential flaws.
Popular open source projects that use unsafe code include Linux (which comprises 95% unsafe code), Tor (93%), MySQL Server (84%) and even Chromium (51%), highlighting the widespread dependency on memory-unsafe languages.
Conversely, projects like WordPress and PowerShell were found to be made up of entirely memory-safe code.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The CISA highlighted the practical challenges faced by developers when it comes to using safer languages, such as performance needs and resource constraints. However the report acknowledges ongoing work: “Recent advancements allow memory safe programming languages, such as Rust, to parallel the performance of memory-unsafe languages.”
The joint report recommends that developers prioritize memory-safe languages for new code as well as transition critical existing components to safer alternatives. Besides language selection, the agencies also emphasize the importance of following secure practices, managing dependencies correctly and conducting methodical testing to identify and mitigate such safety issues.
More from TechRadar Pro
With several years’ experience freelancing in tech and automotive circles, Craig’s specific interests lie in technology that is designed to better our lives, including AI and ML, productivity aids, and smart fitness. He is also passionate about cars and the decarbonisation of personal transportation. As an avid bargain-hunter, you can be sure that any deal Craig finds is top value!
LG Electronics sets ambitious B2B revenue goal to offset declining consumer demand
New fanless cooling technology enhances energy efficiency for AI workloads by achieving a 90% reduction in cooling power consumption
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
