Why do you think the NSA could have put the industry on memory-safe languages?

Even if they wanted to, I highly doubt they could push the industry to do that. The industry does what it wants to do, and rewriting tons of software was far from its priorities. There were no LLMs back then to help with such a massive migration.

There's also the fact that rewriting software tends to introduce a lot of new bugs.

▲

lambdaone an hour ago | parent [-]

The U.S. government could have required all new software for any government-procured system to be written memory-safe languages, thus making it ubiquitous. This could have been phased in slowly with a few years of on-ramp time to allow for industry to acquire the relevant skills.

▲

elcritch an hour ago | parent | next [-]

The DoD tried that with Ada and largely failed. That was with defense contractors whose primary customer mandated it. That was despite Ada being proven to work in its first projects.

▲

terminalcommand an hour ago | parent | prev | next [-]

But even in memory-safe languages, compiler bugs are still an issue. The theory is perfect but the implementation is flawed. In such case once the compiler bugs are found, the software would have to be rewritten to compile. For example an 11 year old memory bug was discovered recently in the rust compiler: https://www.penligent.ai/hackinglabs/rust-borrow-checker-bug....

Memory safe languages are not a silver bullet either.

	▲	GTP an hour ago \| parent [-]
		Definitely not a silver bullet (consider also that memory management isn'the only source for vulns), but still much better than C/C++.

▲

bluGill an hour ago | parent | prev | next [-]

The U.S. government had pushed Ada for years and it never worked out. The government was forced to accept C++ because industry was rebelling against ADA, even though ADA was memory safe. Well, Ada did have the ability to be memory unsafe. It was much better by default.

▲

elzbardico 34 minutes ago | parent | prev [-]

The DoD have even created their own language: ADA. Massive contracts power, but different markets to incentivize.

The distance between the usual consumer/b2b tech startup and the kind of company that sells software to the air force is even bigger than the distance between Google and the kind of company who hires Accenture.