Thom Holwerda Archive
Over the decades, my primary operating system of choice has changed a few times. As a wee child of six years old, we got out first PC through one of those employer buy-a-PC programs, where an employer would subsidize its employees buying PCs for use in the home. The goal here was simple: if people get comfortable with a computer in their private life, they’ll also get comfortable with it in their professional life. And so, through my mother’s employer, we got a brand new 286 desktop running MS-DOS and Windows 3.0. I still have the massive and detailed manuals and original installation floppies it came with. So, my first operating system of ‘choice’ was MS-DOS, and to a far lesser extent Windows 3.0. As my childhood progressed, we got progressively better computers, and the new Windows versions that came with it – Windows 95, 98, and yes, even ME, which I remarkably liked just fine. Starting with Windows 95, DOS became an afterthought, and with my schools, too, being entirely Windows-only, my teenage years were all Windows, all the time. So, when I bought my first own, brand new computer – instead of old 386 machines my parents took home from work – right around when Windows XP came out, I bought a totally legal copy of Windows XP from some dude at school that somehow came on a CD-R with a handwritten label but was really totally legit you guys. I didn’t like Windows XP at all, and immediately started looking for alternatives, trying out Mandrake Linux before discovering something called BeOS – and despite BeOS already being over by that point, I had found my operating system of choice. I tried to make it last as long as the BeOS community would let me, but that wasn’t very long. The next step was a move to the Mac, something that was quite rare in The Netherlands at that time. During that same time, Microsoft released Windows Server 2003, the actually good version of Windows XP, and a vibrant community of people, including myself, started using it as a desktop operating system instead. I continued using this mix of Mac OS X and Windows – even Vista – for a long time, while having various iterations of Linux installed on the side. I eventually lost interest in Mac OS X because Apple lost interest in it (I think around the Snow Leopard era?), and years later, six or seven years ago or so, I moved to Linux exclusively, fully ditching Windows even for gaming like four or so years ago when Valve’s Proton started picking up steam. Nowadays all my machines run Fedora KDE, which I consider to be by far the best desktop operating system experience you can get today. Over the last few years or so, I’ve noticed something fun and interesting in how I set up my machines: you can find hints of my operating system history all over my preferred setup and settings. I picked up all kinds of usage patterns and expectations from all those different operating systems, and I’d like to enable as many of those as possible in my computing environment. In a way, my setup is a reflection of the operating systems I used in the past, an archaeological record of my computing history, an evolutionary tree of good traits that survived, and bad traits bred out. Taking a look at my bare desktop, you’ll instantly pick up on the fact I used to use Mac OS X for a long time. The Mac OS X-like dock at the bottom of the screen has been my preferred way of opening and managing running applications since I first got an iBook G4 more than 20 years ago, and to this day I find it far superior to any alternatives. KDE lets me easily recreate a proper dock, without having to resort to any third-party dock applications. I never liked the magnification trick Mac OS X wowed audiences with when it was new, so I don’t use it. The next dead giveaway I used to be a Mac OS X user a long time ago is the top bar, which shares quite a few elements with the Mac OS X menubar, while also containing elements not found in Mac OS X. I keep the KDE equivalent of a start menu there, a button that brings up my home folder in a KDE folder view, a show desktop button that’s mostly there for aesthetic reasons, KDE’s global menubar widget for that Mac OS X feel, a system tray, the clock, and then a close button that opens up a custom system menu with shutdown/reboot/etc. commands and some shortcuts to system tools. Another feature coming straight from my days using Mac OS X is KDE’s equivalent of Exposé, called Overview, without which I wouldn’t know how to find a window if my life depended on it. I bind it to the top-left hotcorner for easy access with my mouse, while the bottom-right hotcorner is set to show my desktop (and the reason why I technically don’t really need that show desktop button I mentioned earlier). I fiddled with the hot corner trigger timings so that they fire virtually instantly. Waiting on my computer is so ’90s. It’s not really possible to see in screenshots, but my stint using BeOS as my main operating system back when that was a thing you could do also shines through, specifically in the way I manage windows. In BeOS, double-clicking a titlebar tab would minimise a window, and right-clicking the tab would send the window to the bottom of the Z-stack. I haven’t maximised a non-video window in several decades, so I find double-clicking a titlebar to maximise a window utterly baffling, and a ridiculous Windows-ism I want nothing to do with. Once again, KDE lets me set this up exactly the way I want, and I genuinely feel lost when I can’t manipulate my windows in this
OpenBSD 7.6, the release in which every single line of the original code form the first release has been edited or removed, has been released. There’s a lot of changes, new features, bug fixes, and more in 7.6, but for desktop users, the biggest new feature is undoubtedly hardware-accelerated video decoding through VA-API. Or, as the changelog puts it: Imported libva 2.22.0, an implementation for VA-API (video acceleration API). VA-API provides access to graphics hardware acceleration capabilities for video processing. ↫ OpenBSD 7.6 release announcement This is a massive improvement for anyone using OpenBSD for desktop use, especially on power-constrained devices like laptops. Problematic video playback was one of the reasons I went back to Fedora KDE after running OpenBSD on my workstation, and it seems this would greatly improve that situation. I can’t wait until I find some time to reinstall OpenBSD and see how much difference this will make for me personally. There’s more, of course. OpenBSD 7.6 starts the bring-up for Snapdragon X Elite devices, and in general comes with a whole slew of low-level improvements for the ARM64 architecture. AMD64 systems don’t have to feel left out, thanks to AVX-512 support, several power management improvements to make sleep function more optimally, and several other low-level improvements I don’t fully understand. RISC-V, PowerPC, MIPS, and other architectures also saw small numbers of improvements. The changelog is vast, so be sure to dig through it to see if your pet bug has been addressed, or support for your hardware has been improved. OpenBSD users will know how to upgrade, and for new installations, head on over to the download page.
Late last year, Google’s Play Store was ruled to be a monopoly in the US, and today the judge in that case has set out what Google must do to address this situation. Today, Judge James Donato issued his final ruling in Epic v. Google, ordering Google to effectively open up the Google Play app store to competition for three whole years. Google will have to distribute rival third-party app stores within Google Play, and it must give rival third-party app stores access to the full catalog of Google Play apps, unless developers opt out individually. ↫ Sean Hollister at The Verge On top of these rather big changes, Google also cannot mandate the use of Google’s own billing solution, nor can it prohibit developers from informing users of other ways to download and/or pay for an application. Furthermore, Google can’t make sweetheart deals with device makers to entice them to install the Play Store or to block them from installing other stores, and Google can’t pay developers to only use the Play Store or not use other stores. It’s a rather comprehensive set of remedies that will remain in force for three years. Many of these remedies are taken straight from the European Union’s Digital Markets Act, but they will be far less effective since they’re only applied to one company, and only for three years. On top of that, Google can appeal, and the company has already stated that it’s going to ask for an immediate stay on these remedies, and if they get that stay, the remedies won’t have to be implemented any time soon. This legal tussling is far from over, and does very little to protect consumer choice. A clear law that simply prohibits this kind of market abuse, like the DMA, is much fairer to everyone involved, and creates a consistent level playing field for everyone, instead of only affecting random companies based on the whims of something as unpredictable as juries. In other words, I don’t think much is going to change in the United States after this ruling, and we’ll likely be hearing more back and forths in the court room for years to come, all while US consumers are being harmed. It’s better than nothing in lieu of a working Congress actually doing, well, anything, but that’s not saying much.
You have to wonder how meaningful this news is in 2024, but macOS 15.0 Sequoia running on either Apple Silicon or Intel processors is now UNIX 03-certified. The UNIX 03 Product Standard is the mark for systems conforming to Version 3 of the Single UNIX Specification. It is a significantly enhanced version of the UNIX 98 Product Standard. The mandatory enhancements include alignment with ISO/IEC 9989:1999 C Programming Language, IEEE Std 1003.1-2001 and ISO/IEC 9945:2002. This Product Standard includes the following mandatory Product Standards: Internationalized System Calls and Libraries Extended V3,Commands and Utilities V4, C Language V2, and Internationalized Terminal Interfaces. ↫ UNIX 03 page The questionable usefulness of this news stems from a variety of factors. The UNIX 03 specification hails from the before time of 2002, when UNIX-proper still had some footholds in the market and being a UNIX meant something to the industry. These days, Linux has pretty much taken over the traditional UNIX market, and UNIX certification seems to have all but lost its value. Only one operating system can boast to conform to the latest UNIX specification – AIX is UNIX V7 and 03-certified – while macOS and HP-UX are only UNIX 03-certified. OpenWare, UnixWare, and z/OS only conform to even older standards. On top of all this, it seems being UNIX-certified by The Open Group feels a lot like a pay-to-play scheme, making it unlikely that community efforts like, say, FreeBSD, Debian, or similarly popular server operating systems could ever achieve UNIX-certification even if they wanted to. This makes the whole UNIX-certification world feel more like the dying vestiges of a job security program than something meaningful for an operating system to aspire to. In any even, you can now write a program that compiles and runs on all two UNIX 03-certified operating systems, as long as it only uses POSIX APIs.
A YouTube channel has resurrected a programming language that hadn’t been seen since the 1980s — in a testament to both the enduring power of our technology, and of the communities that care about it. But best of all, Simpson uploaded the language to the Internet Archive, along with all his support materials, inviting his viewers to write their own programs (and saying he hoped his upstairs neighbor would’ve approved). And in our email interview, Simpson said since then it’s already been downloaded over 1,000 times — “which is pretty amazing for something so old.” ↫ David Cassel It’s great that this lost programming language, MicroText for the Commodore 64, was rediscovered, but I’m a bit confused as to how “lost” this language really was. I mean, it was “discovered” in a properly listed eBay listing, which feels like cheating to me. When I think of stories of discoveries of long-lost software, games, or media, it usually involves things like finding it in a shed after years of searching, or someone at a company going through that box of old hard drives discovering the game they worked on 32 years ago. I don’t know, something about this whole story feels off to me, and it’s ringing some alarm bells I can’t quite place. Regardless, it’s cool to have MicroText readily available on the web now, so that people can rediscover it and create awesome new things with it. Perhaps there’s old ideas to be relearned here.
In ancient Greek mythology, Kassandra, priestess of Apollo and daughter of King Priam and Queen Hecuba of Troy, was granted the gift of prophecy by Apollo, in return for “favours”. When Kassandra then decided to, well, not grant any “favours”, Apollo showcased that as a good son of Zeus, he did not understand consent either, and cursed her by making sure nobody would believe her prophecies. There’s some variations to the story from one author or source to the next, but the general gist remains the same. Anyway, I’ve been warning everyone about the fall of Mozilla and Firefox for years now, so here’s another chapter in the slow decline and fall of Mozilla: they’re now just flat-out stating they’re an online advertising company. As Mark shared in his blog, Mozilla is going to be more active in digital advertising. Our hypothesis is that we need to simultaneously work on public policy, standards, products and infrastructure. Today, I want to take a moment to dive into the details of the “product” and “infrastructure” elements. I will share our emerging thoughts on how this will come to life across our existing products (like Firefox), and across the industry (through the work of our recent acquisition, Anonym, which is building an alternative infrastructure for the advertising industry). ↫ Laura Chambers Pretty much every one of my predictions regarding the slow downfall of Mozilla are coming true, and we’re just waiting around now for the sword of Damocles to drop: Google ending its funding for Mozilla, which currently makes up about 80% of the former browser maker’s revenue. Once this stream of free money dries up, Mozilla’s decline will only accelerate even more, and this is probably why they are trying to get into the online advertising business in the first place. How else are you going to make money from a browser? In the meantime, the operating system most reliant on Firefox existing as a privacy-respecting browser, desktop Linux, still seems to be taking no serious steps to prepare for this seeming inevitability. There’s no proper Firefox fork, there’s no Chromium variant with the kind of features desktop users expect (tab sharing, accounts, etc., which are not part of Chromium), nothing. There’s going to be a point where shipping a further enshittified Firefox becomes impossible, or at the least highly contentious, for Linux distributions, and I don’t see any viable alternative anywhere on the horizon. I’m sure things will turn out just fine.
Remember earlier this year, when Android Authority discovered Google was experimenting with letting you run full Chrome OS on your Android device? In case you were wondering if that particular piece of spaghetti was sticking to the wall, I’m sorry to disappoint you it isn’t. Despite creating the Ferrochrome launcher app, which would’ve made the whole thing a one-click affair, Google has just removed the whole concept from the Android code base altogether. Unfortunately, though, Google has decided to kill its Ferrochrome launcher app. This was revealed to us by a code change recently submitted to the AOSP Gerrit. The code change, which hasn’t been merged yet, removes the entire Ferrochrome launcher app from AOSP. Google’s reason for removing this app is that it doesn’t plan to ship it or maintain its code. It seems that Google is shifting towards using the Linux-based Debian distro instead of Chrome OS as its testbed for AVF development. ↫ Mishaal Rahman at Android Authority I’m not really sure if people were really asking for something like this, and to Google’s credit – for once – the company never even so much as hinted at releasing this to the general public. Still, the idea of carrying just your phone with you as your primary computer, and plugging into a display and input devices as the need arises, remains something a lot of people are fascinated with, and putting Chrome OS on your Android phone would’ve been one way to achieve this goal. Despite decades of attempts, it seems not even the smartest people in Silicon Valley can crack this nut. Perhaps they should ask Gemini to solve it for them? It doesn’t involve pizza’s, glue, or rocks, so who knows – it might surprise them!
For nearly 15 years, FreeBSD has been at the core of my personal infrastructure, and my passion for it has only grown over time. As a die-hard fan, I’ve stuck with BSD-based systems because they continue to deliver exactly what I need—storage, networking, and security—without missing a beat. The features I initially fell in love with, like ZFS, jails, and pf, are still rock-solid and irreplaceable. There’s no need to overhaul them, and in many ways, that reliability is what keeps me hooked. My scripts from 20 years ago still work, and that’s a rare kind of stability that few platforms can boast. It’s not just me, either—big names like Netflix, Microsoft, and NetApp, alongside companies like Tailscale and AMD, continue to support FreeBSD, further reinforcing my belief in its strength and longevity (you can find the donators and sponsors right here). Yet, while this familiarity is comforting, it’s becoming clear that FreeBSD must evolve to keep pace with the modern landscape of computing. ↫ gyptazy It’s good to read so many articles and comments from long-time FreeBSD users and contributors who seem to recognise that there’s a real opportunity for FreeBSD to become more than ‘just’ a solid server operating system. This aligns neatly with FreeBSD itself recognising this, too, and investing in improving the operating system’s support for what are not considered basic laptop features like touchpad gestures and advanced sleep states, among other things. I’ve long held the belief that the BSDs are far closer to attracting a wider, more general computing-focused audience than even they themselves sometimes seem to think. There’s a real, tangible benefit to the way BSDs are developed and structured – a base system developed by one team – compared to the Linux world, and there’s enough disgruntlement among especially longtime Linux users about things like Wayland and systemd that there’s a pool of potential users to attract that didn’t exist only a few years ago. If you’re a little unsure about the future of Linux – give one of the BSDs a try. There’s a real chance you’ll love it.
In case you missed it at the 2024 Samsung Developer Conference today, our partners at Samsung Visual Display discussed the work they have been doing to port the Tizen operating system to RISC-V. Tizen is an open-source operating system (OS) that is used in many Samsung smart T.V.s and it makes sense that they would look to the fast growing, global open-standard RISC-V to develop future systems. The presentation showed the results of efforts at both companies to expand the capabilities of the already robust Tizen approach. At the event they also demonstrated a T.V. running on RISC-V and using a SiFive Performance P470 based core. ↫ John Ronco The announcement is sparse on details, and there isn’t much more to add than this, but the reality is that of course Samsung was going to port Tizen to RISC-V. The growing architecture is bound to compete with the industry standard ARM in a variety of market segments, and it makes perfect sense to have your TV and other (what we used to call) embedded operating systems ready to go.
Hot on the heels of releasing Redox 0.9.0, the team is back with yet another monthly update. Understandably, it’s not as massive of an update as other months, but there’s still more than enough here. There’s the usual bug fixes and small changes, but also more work on the port to RISC-V, the QEMU port (as in, running QEMU on Redox), a bunch of improvements to Relibc, and a lot more.
Windows 11 2024 Update, also known as version 24H2, is now publicly available. Microsoft announced the rollout alongside the new AI-powered features that are coming soon to Windows Insiders with Copilot+ PCs and Copilot upgrades. Unlike recent Windows 11 updates, version 24H2 is a “full operating system swap,” so updating to it will take more time than usual. What is going as usual is the way the update is being offered to users. Microsoft is gradually rolling out the update to “seekers” with Windows 11 versions 22H2 and 23H2. That means you need to go to the Settings app and manually request the update. ↫ Taras Buria at Neowin I’ve said it a few times before but I completely lost track of how Windows releases and updates work at this point. I thought this version and its features had been available for ages already, but apparently I was wrong, and it’s only being released now. For now, you can get it by opting in through Windows Update, while the update will be pushed to everyone later on. I really wish Microsoft would move to a simpler, more straightforward release model and cadence, but alas. Anyway, this version brings all the AI/ML CoPilot stuff, WiFi 7 support, improvements to File Explorer and the system tray, the addition of the sudo command, and more. The changes to Explorer are kind of hilarious to me, as Microsoft seems to have finally figured out labels are a good thing – the weird copy/cut/paste buttons in the context menu have labels now – but this enhanced context menu still has its own context menu. Explorer now also comes with support for more compression formats, which is a welcome change in 2007. To gain access to the new sudo command, go to Settings > System > For developers and enable the option. For the rest, this isn’t a very impactful release, and will do little to convince the much larger Windows 10 userbase to switch to Windows 11, something that’s going to be a real problem for Microsoft in the coming year.
In 1999, some members from the MMC Association decided to split and create SD Association. But nobody seems to exactly know why. ↫ sdomi’s webpage I don’t even know how to summarise any of this research, because it’s not only a lot of information, it’s also deeply bureaucratic and boring – it takes a certain kind of person to enjoy this sort of stuff, and I happen to fit the bill. This is a great read.
FreeBSD is going to take its desktop use quite a bit more seriously going forward. FreeBSD has long been a top choice for IT professionals and organizations focused on servers and networking, and it is known for its unmatched stability, performance, and security. However, as technology evolves, FreeBSD faces a significant challenge: supporting modern laptops. To address this, the FreeBSD Foundation and Quantum Leap Research has committed $750,000 to improve laptop support, a strategic investment that will be pivotal in FreeBSD’s future. ↫ FreeBSD Foundation blog So, what are they going to spend this big bag of money on? Well, exactly the kind of things you expect. They want to improve and broaden support for various wireless chipsets, add support for modern powersaving processor states, and make sure laptop-specific features like touchpad gestures, specialty buttons, and so on, work properly. On top of that, they want to invest in better graphics driver support for Intel and AMD, as well as make it more seamless to switch between various audio devices, which is especially crucial on laptops where people might reasonably be expected to use headphones. In addition, while not specifically related to laptops, FreeBSD also intends to invest in support for heterogeneous cores in its scheduler and improvements to the bhyve hypervisor. Virtualisation is, of course, not just something for large desktops and servers, but also laptop users might turn to for certain tasks and workloads. The FreeBSD project will be working not just with Quantum Leap Research, but also various hardware makers to assist in bringing FreeBSD’s laptop support to a more modern, plug-and-play state. Additionally, the mentioned cash injection is not set in stone; additional contributions from both individuals and larger organisations are obviously welcome, and of course if you can contribute code, bug reports, documentation, and so on, you’re also more than welcome to jump in.
Recently I came across a minor mystery—the model numbers of the original IBM PC. For such a pivotal product, there is remarkably little detailed original information from the early days. ↫ Michal Necasek Count me surprised. When I think IBM, I think meticulously documented and detailed bureaucracy, where every screw, nut, and bolt is numbered, documented, and tracked, so much so in fact this all-American company even managed to impress the Germans. You’d expect IBM, of all companies, to have overly detailed lists of every IBM PC it ever designed, manufactured, and sold, but as it turns out, it’s actually quite hard to assemble a complete list of the early IBM PCs the company sold. The biggest problem are the models from before 1983, since before that year, the IBM PC does not appear in IBM’s detailed archive of announcements. As such, Michal Necasek had to dig into random bits of IBM documentation to assemble references to those earlier models, and while he certainly didn’t find every single one of them, it’s a great start, and others can surely pick up the search from here.
When Valve took its second major crack at making Steam machines happen, in the form of the Steam Deck, one of the big surprises was the company’s choice to base the Linux operating system the Steam Deck uses on Arch Linux, instead of the Debian base it was using before. It seems this choice is not only benefiting Valve, but also Arch. We are excited to announce that Arch Linux is entering into a direct collaboration with Valve. Valve is generously providing backing for two critical projects that will have a huge impact on our distribution: a build service infrastructure and a secure signing enclave. By supporting work on a freelance basis for these topics, Valve enables us to work on them without being limited solely by the free time of our volunteers. ↫ Levente Polyak This is great news for Arch, but of course, also for Linux in general. The work distributions do to improve their user experience tend to be picked up by other distributions, and it’s clear that Valve’s contributions have been vast. With these collaborations, Valve is also showing it’s in it for the long term, and not just interested in taking from the community, but also in giving, which is good news for the large number of people now using Linux for gaming. The Arch team highlights that these projects will follow the regular administrative and decision-making processes within the distribution, so we’re not looking at parallel efforts forced upon everyone else without a say.
California Governor Gavin Newsom has signed a law (AB 2426) to combat “disappearing” purchases of digital games, movies, music, and ebooks. The legislation will force digital storefronts to tell customers they’re just getting a license to use the digital media, rather than suggesting they actually own it. When the law comes into effect next year, it will ban digital storefronts from using terms like “buy” or “purchase,” unless they inform customers that they’re not getting unrestricted access to whatever they’re buying. Storefronts will have to tell customers they’re getting a license that can be revoked as well as provide a list of all the restrictions that come along with it. Companies that break the rule could be fined for false advertising. ↫ Emma Roth at The Verge A step in the right direction, but a lot more is definitely needed. This law in particular seems to leave a lot of wiggle room for companies to keep using the “purchase” term while hiding the disclosure somewhere in the very, very small fine print. I would much rather a law like this just straight up ban the use of the term “purchase” and similar terms when all you’re getting is a license. Why allow them to keep lying about the nature of the transaction in exchange for some fine print somewhere? The software industry in particular has been enjoying a free ride when it comes to consumer protection laws, and the kind of malpractice, lack of accountability, and laughable quality control would have any other industry shut down in weeks for severe negligence. We’re taking baby steps, but it seems we’re finally arriving at a point where basic consumer protection laws and rights are being applied to software, too. Several decades too late, but at least it’s something.
System76, the premiere Linux computer manufacturer and creator of the COSMIC desktop environment, has updated COSMIC’s Alpha release to Alpha 2. The latest release includes more Settings pages, the bulk of functionality for COSMIC Files, highly requested window management features, and considerable infrastructure work for screen reader support, as well as some notable bug fixes. ↫ system76’s blog The pace of development for COSMIC remains solid, even after the first alpha release. This second alpha keeps adding a lot of things considered basic for any desktop environment, such as settings panels for power and battery, sounds, displays, and many more. It also brings window management support for focus follows cursor and cursor follows focus, which will surely please the very specific, small slice of people who swear by those. Also, you can now disable the super key. A major new feature that I’m personally very happy about is the “adjust density” feature. COSMIC will allow you to adjust the spacing between the various user interface elements so you can choose to squeeze more information on your screen, which is one of the major complaints I have about modern UI design in macOS, Windows, and GNOME. Being able to adjust this to your liking is incredibly welcome, especially combined with COSMIC’s ability to change from ’rounded’ UI elements to ‘square’ UI elements. The file manager has also been vastly, vastly improved, tons of bugs were fixed, and much, much more. It seems COSMIC is on the right path, and I can’t wait to try out the first final result once it lands.
Tcl 9.0 and Tk 9.0 – usually lumped together as Tcl/Tk – have been released. Tcl 9.0 brings 64bit compatibility so it can address data values larger than 2 GB, better Unicode support, support for mounting ZIP files as file systems, and much, much more. Tk 9.0 gets support for scalable vector graphics, much better platform integration with things like system trays, gestures, and so on, and much more.
Just want to let y’all know that my family and I have been hit hard with bronchitis these past two weeks, and especially my recovery is going quite slowly (our kids are healthy again, and my wife is recovering quite well!). As such, I haven’t been able to do much OSNews work. I hope things will finally clear up a bit over the weekend so that I can resume normal service come Monday. Enjoy your weekend, y’all!
The push towards memory safe programming languages is strong, and for good reason. However, especially for bigger projects with a lot of code that potentially needs to be rewritten or replaced, you might question if all the effort is even worth it, particularly if all the main contributors would also need to be retrained. Well, it turns out that merely just focusing on writing new code in a memory safe language will drastically reduce the number of memory safety issues in a project as a whole. Memory safety vulnerabilities remain a pervasive threat to software security. At Google, we believe the path to eliminating this class of vulnerabilities at scale and building high-assurance software lies in Safe Coding, a secure-by-design approach that prioritizes transitioning to memory-safe languages. This post demonstrates why focusing on Safe Coding for new code quickly and counterintuitively reduces the overall security risk of a codebase, finally breaking through the stubbornly high plateau of memory safety vulnerabilities and starting an exponential decline, all while being scalable and cost-effective. ↫ Jeff Vander Stoep and Alex Rebert at the Google Security Blog In this blog post, Google highlights that even if you only write new code in a memory-safe language, while only applying bug fixes to old code, the number of memory safety issues will decreases rapidly, even when the total amount of code written in unsafe languages increases. This is because vulnerabilities decay exponentially – in other words, the older the code, the fewer vulnerabilities it’ll have. In Android, for instance, using this approach, the percentage of memory safety vulnerabilities dropped from 76% to 24% over 6 years, which is a great result and something quite tangible. Despite the majority of code still being unsafe (but, crucially, getting progressively older), we’re seeing a large and continued decline in memory safety vulnerabilities. The results align with what we simulated above, and are even better, potentially as a result of our parallel efforts to improve the safety of our memory unsafe code. We first reported this decline in 2022, and we continue to see the total number of memory safety vulnerabilities dropping. ↫ Jeff Vander Stoep and Alex Rebert at the Google Security Blog What this shows is that a large project, like, say, the Linux kernel, for no particular reason whatsoever, doesn’t need to replace all of its code with, say, Rust, again, for no particular reason whatsoever, to reap the benefits of a modern, memory-safe language. Even by focusing on memory-safe languages only for new code, you will still exponentially reduce the number of memory safety vulnerabilities. This is not a new discovery, as it’s something observed and confirmed many times before, and it makes intuitive sense, too; older code has had more time to mature.
