The C++ Conundrum: White House Pushes for Memory-Safe Programming

In a surprising move, the Biden administration has taken a stance on software development practices, urging programmers to move away from languages like C and C++ in favor of memory-safe alternatives. This recommendation, coming from the White House Office of the National Cyber Director (ONCD), has sparked debate in the tech community and raised questions about the future of software development.

The ONCD’s 19-page report, released in February 2024, emphasizes the need to adopt memory-safe programming languages to reduce cybersecurity vulnerabilities. National Cyber Director Harry Coker stated, “We, as a nation, have the ability—and the responsibility—to reduce the attack surface in cyberspace and prevent entire classes of security bugs from entering the digital ecosystem.”

This push comes in response to alarming statistics from Microsoft and Google, which found that approximately 70% of all security vulnerabilities are caused by memory safety issues. The government’s stance aligns with recommendations from other agencies, including the US Cybersecurity and Infrastructure Security Agency (CISA), which has also advocated for memory-safe languages.

While C and C++ remain popular, with about 22% and 19% of programmers using them respectively as of 2023, the government is promoting alternatives like Rust, C#, Go, Java, Ruby, and Swift. This shift could have significant implications for the software industry, potentially influencing hiring practices, education curricula, and project development strategies.

However, the transition won’t be immediate or universal. Dan Grossman, a computer science professor at the University of Washington, notes that while “dangers of C and C++ have been well-known for decades,” the change will be gradual, especially in embedded systems. The report acknowledges this, suggesting a focus on rewriting high-risk components as a starting point.

Companies are already responding to this call. Major tech firms like Microsoft and Google have been investing in memory-safe languages, with Rust gaining particular traction in systems programming. However, the vast existing codebase in C and C++ presents a significant challenge for wholesale migration.

The White House’s stance on memory-safe programming languages marks a significant moment in software development history. As the industry grapples with this recommendation, we’re likely to see a slow but steady evolution towards safer coding practices, balancing security needs with the practical realities of existing systems and developer expertise.