Thankfully we have already made good progress towards things like arm memory tagging and memory safe languages.
It’s a rocky period right now but the future will be much more secure after all the low hanging fruit are found.
Thankfully we have already made good progress towards things like arm memory tagging and memory safe languages.
It’s a rocky period right now but the future will be much more secure after all the low hanging fruit are found.
There's still no x86_64 processors on the market with MTE and it was only recently standardised between Intel and AMD. It's going to be 10+ years before memory tagging is widespread on desktop, and 5 years for Android/iOS devices.
That's definitely an improvement, but it's just one aspect of cybersecurity. Logical errors allowing people to e.g. log into services and extract data are likely everywhere still.
If we can eliminate entire classes of bugs from being possible. It frees up resources to investigate the ones that are still possible.
I suspect after a few years of LLM assisted bug hunting, everything will have a baseline security that is very good. Much like how stronger viruses simply create stronger immune systems.
How many devices/operating systems even use memory tagging? iOS, macOS and GrapheneOS, I think that's it? And iOS/macOS only use it for the kernel, a subset of system processes, and I think applications can opt in to it.
Heck, Google may have even hampered MTE in Pixel 11 (since support has been disabled) and Snapdragon 8 Gen 5 only got basic support.
We are moving way to slowly adopting hardware mitigations and memory-safe languages.
There's some positive news from the GrapheneOS devs on Pixel 11 in the past week that's worth reading up on. The MTE hardware feature is still there, they're just not sure why Google disabled it
I am well-aware, closely following them on Mastodon. That's why I said may have hampered. There may be some CPU errata that posed them to disable it.
They said:
> It isn't clear if there are serious CPU errata or it simply performs very badly.
Meaning it's there but not terribly functional. They also said it's unreliable.