Tara from Sovereign Tech Agency and Hugo will be hosting the next 'Memory Safety in the EU' meeting in Amsterdam, on Tue 26 Aug (during #OSSummit).

The meeting aims to finalise a statement on the importance of memory safety for security by design. This is a joint effort by several European stakeholders to put memory safety on the agenda of both industry and policy makers.

Read more here: https://tweedegolf.nl/en/blog/160/update-on-our-advocacy-for-memory-safety

@tarakiyee
@sovtechfund

We’ve been emphasising the importance of using memory-safe technology to build secure-by-design systems for years now.

Read a status update in Hugo's blog:
https://tweedegolf.nl/en/blog/160/update-on-our-advocacy-for-memory-safety

@sovtechfund
@openssf
@rustfoundation
@ProssimoISRG

The success story of the memory-safe sudo-rs, the Rust implementation of the sudo command, in an article from Prossimo, where it all began: https://www.memorysafety.org/blog/sudo-rs-headed-to-ubuntu/

We started work on sudo-rs in 2022, with @ferrous, for @ProssimoISRG. In 2024, sudo-rs moved to @trifectatech. We're still working on it: maintenance, improvements, and readying for various distributions, of which Ubuntu 25.10 is the biggest milestone so far!

One of our founding directors, Mike Eftimakis, sat down with Akshaya Asokan from Information Security Media Group (ISMG) to explore how CHERI is helping tackle one of cybersecurity’s biggest challenges: memory safety.

CHERI (Capability Hardware Enhanced RISC Instructions) is a hardware-based approach to security, designed to prevent around 70% of today’s common vulnerabilities. Backed by industry leaders and the UK government, we're working to ensure global adoption across the electronics supply chain.

Watch the interview to learn more about:

How CHERI addresses memory safety issues
Common hardware supply chain vulnerabilities
Progress on adoption by chipmakers
Scalability challenges associated with CHERI

Watch the full interview: https://www.bankinfosecurity.com/uks-cheri-alliance-expands-to-global-hardware-supply-chain-a-28942

The CHERI Alliance is all about bringing the computing world together to adopt CHERI security technology.

We’re a mix of industry partners, open-source contributors, researchers, and governments, all working to make CHERI more accessible and widely used.

Check out who’s already on board: https://cheri-alliance.org/member/

We’ve got active working groups tackling everything from software porting to system integration and standards - all helping the community adopt and build with CHERI more effectively. Take a look: https://cheri-alliance.org/who-we-are/working-groups/

Curious? Keen to get involved? Here’s how to join us: https://cheri-alliance.org/memberships/

The @cheri_alliance has around a thousand followers on LinkedIn and just joined the Fediverse today. Let’s see how quickly we can get them to more than that here!

Hey infosec.exchange! We’re the CHERI Alliance — excited to join the community!

We’re all about CHERI (Capability Hardware Enhanced RISC Instructions) — a powerful hardware-based approach to making memory safety and software security actually enforceable, by design.

CHERI helps stop things like buffer overflows and use-after-free bugs before they cause trouble — with hardware-enforced protections built right into the architecture.

We’re here to:
- Share news about the CHERI community in general
- Talk about what our members are building with CHERI
- Connect with folks who care about deep, meaningful security improvements
Check us out cherialliance.org

Give us a follow if this sounds like your kind of thing!

The latest joint guidance from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA) elevates memory-safe languages such as Rust, Go, Java, Python, and C# from “best practice” to a national-security baseline.

https://forum.hashpwn.net/post/677

" 'Memory Safety' is the new 'eat your veggies' of tech that everyone's pretending to care about. USENIX obsesses over it like it's the Holy Grail, but in reality, it's just the bare minimum, like wearing pants to a meeting. Spoiler: No one actually reads #governance minutes, ever."
https://www.usenix.org/publications/loginonline/memory-safety-merely-table-stakes #MemorySafety #TechCulture #Humor #BareMinimum #HackerNews #ngated

Memory Safety Is Merely Table Stakes

https://www.usenix.org/publications/loginonline/memory-safety-merely-table-stakes

Is Linux insecure because it’s written in memory unsafe language ?
Should it be rewritten?

https://www.cisa.gov/resources-tools/resources/product-security-bad-practices

“half of tracked security vulnerabilities are not possible in Rust”
- - tpo/core/arti

#oniux
has anyone tested with #Wireshark ?
#audit
But you can verify oniux bash with curl. With

→ oniux bash each time in a new tab in terminal ←

you will have stream isolated the application with a new exit IP (tor circuit), new ephemeral PID.

Nothing like nyx to test without the control port, but a rs network analysis tool could.
#StreamIsolation #MemorySafety #Rustlang #Kernel #tun

but this core project really needs some work (No one knows the name of who they are so impressed with. I've asked.)

The Masked Onion Dance Cascades (whose mutable/static number where)
https://0xacab.org/leap/tor/onionmasq/-/blob/main/README.md

* ipv6 bind all interfaces
not good for mobile, see note here
https://major.io/p/enable-ipv6-privacy-networkmanager/
ipv6 privacy on Kernel level (sysctl tunable)

* private ipv4 (the router did it, not the device!)
reserved address 169.254.42.2

onion0 (as in router not site) interface

→ What are those 56 characters? Actually, a General Public for a Private Specific (undisclosed IP).

A site is not an interface. Not a particular “military number” or Swiss IBAN that can’t be used because there is no RingCT ( https://iban.com/glossary proxy chains ).

#defcon25
Properties of an onionsite
→ Location Hiding - service IP Address [protected]
xmr . . . onion /onion-services/overview/index.html
* no impersonation, E2EE pub/priv directory and binding
* NAT punching – like TURN server (conf) – P2P past a firewall / AP
https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_NAT

#Rustlang #overflow #MemorySafety #Tor #Android #App #AndroidStudio

Fall for nothing. Period!

Just know and not assume that the military police state is a bunch of cheats and liars.

→ towards Whodora-rs for #mobile

Day 1 of posting to social media until I get an offensive security research job

First, I’m going to start with what I know – Windows. I need to recreate what I had access to at Microsoft, so that starts by setting up a dev environment and finding a copy of Windows System Internals, perhaps the greatest resource for learning Windows out there. My expertise is in Windows and virtualization, so I’m going to make sure I master those areas.

Next, I don’t think I want to grind coding exercises, but I do need to shake the rust off my coding skills. I think I’m going to start with some HackTheBox challenges and find some CTFs to participate in.

Finally, my long overdue goal: learn Rust. I’m not sure if this will help immediately, as I could choose to improve my knowledge of Python. But Rust was getting more and more popular in the areas of Windows I was tasked with protecting, so I need to learn what all the fuss is about with regards to memory safety.

If anyone is on a similar journey, let’s hold each other accountable in the comments! I will be sure to document any write-ups at blog.maxrenke.com (work in progress).

Memory Safety Features in Zig

https://gencmurat.com/en/posts/memory-safety-features-in-zig/

Exploring Memory Safety Features in Zig: A Developer's Guide

Zig is carving out its niche in the programming landscape with a robust approach to memory safety that combines manual management with sophisticated safety mechanisms. This article delves into Zig's c...

https://news.lavx.hu/article/exploring-memory-safety-features-in-zig-a-developer-s-guide

Are you ready to unlock the power of Rust? Join my brand-new live online training: "Mastering Memory Safety & Performance with Rust"

Learn just in 1 day how to write fast, safe, and efficient code with Rust. Sign-up here: https://www.sqlpassion.at/live-trainings/mastering-memory-safety-performance-with-rust/ #rust #rustlang #memorysafety #performance

“Ask HN: Memory-Safe Low Level Languages?”, Hacker News (https://news.ycombinator.com/item?id=43811487).