Why the White House Wants Developers to Abandon C and C++ for Memory‑Safe Languages

Developers, beware: the U.S. government is pushing for a shift away from C and C++ toward memory‑safe programming languages, especially in Europe and North America.

The White House Office of the National Cyber Director (ONCD) released a report urging the use of "memory‑safe" languages as part of President Biden’s cybersecurity strategy.

What Is "Memory Safety"?

Memory safety means preventing errors and vulnerabilities that arise from improper memory access.

Typical issues include buffer overflows and dangling pointers. Languages such as Java and the emerging Rust are considered memory‑safe because they provide runtime error detection, whereas C and C++ allow unchecked pointer arithmetic.

In 2019, Microsoft security engineers reported that roughly 70% of vulnerabilities stem from memory‑safety problems; Google reported the same figure in 2020 based on Chromium bugs.

The report explicitly labels C and C++ as "unsafe" and recommends dozens of memory‑safe alternatives, though it does not prescribe a single replacement.

NSA’s own list of recommended memory‑safe languages includes:

Rust

Go

C#

Java

Swift

JavaScript

Ruby

According to the TIOBE index, these languages are all within the top 20 most popular, with Python leading the chart.

The ONCD also calls for best practices and memory‑safe hardware/software to reduce attack surfaces, though it does not detail which languages qualify.

In November 2022, the NSA published a cybersecurity information sheet that expands on the list of memory‑safe languages.

Why This Matters

The report stresses that responsibility for software security should shift from individuals and small firms to large organizations, tech companies, and the federal government, which are better equipped to manage evolving threats.

It cites the 2021 Log4j zero‑day vulnerability as a stark reminder of the risks posed by insecure code.

Experts, including Washington University professor Dan Grossman, argue that the timing is right for the White House to promote memory‑safe alternatives, given the availability of mature replacements.

Changing the Landscape

Transitioning away from C and C++ will be a long, difficult process, especially for embedded systems, but languages like Rust are gaining rapid adoption.

Government and industry must collaborate to prioritize secure code development and allocate resources accordingly.