The Open Source Security Foundation (OpenSSF) and the Linux Foundation released an action plan to improve open source software's security and resilience. Part of that is eliminating non-memory-safe programming languages like C and C++.

The action plan specifically proposes a $5.5 million investment to remove root causes of vulnerabilities by replacing non-memory-safe languages.

Programming languages like C and C++ create challenges for memory safety and difficulties in finding and eliminating defects. Languages like Go and Rust, however, "handle memory management and other kinds of security-sensitive tasks safely by default." This makes it easier for developers to avoid entire vulnerability categories, according to the plan.

For context, in 2020 Google reported that 70% of Chrome's vulnerabilities were a result of memory management and safety issues, and 70% of Microsoft's vulnerabilities between 2006 and 2018 resulted from memory safety issues.

"Identifying small, self-contained, critical components that are good candidates for being rewritten in a memory-safe language, and facilitating these rewrites, could help eliminate an entire category of such weaknesses," the plan reads. "This stream would resource that development work, as well as the associated promotion, adoption, and community development activities to make the new code bases the industry standard."

These investment proposals come after executives from Amazon, Microsoft, Google, and other top tech companies at a White House meeting called for bigger investments in open source security and better developer support.

The action plan — which arrived after a meeting in Washington DC last Thursday between open source developer and ecosystem representatives and leaders from U.S. federal agencies — identifies 10 streams of investment that will concretely and immediately improve the security of open source software, according to OpenSSF.

According to the plan, those investment focuses are based on three overall goals discussed at January's meeting:

  1. Secure open source security production by preventing security vulnerabilities in code and open source packages in the first place.
  2. Improve vulnerability discovery and remediation by speeding up the process of finding and fixing issues.
  3. Shorten ecosystem patching response time for developing and distributing fixes.

Overall, open source security maintainers often don’t have sufficient resources to counter threat actors. But sufficient funding, automation, and economies of scale can address this imbalance. “We can’t assume existing maintainers on even well-resourced OSS efforts will be able to keep up with a moderate volume of new potential defects. Finding is not enough — that must be paired with resources to remediate,” the plan states.