I know it's trendy to hate on C but most security bugs are not memory access related errors. Most are logic errors which any language is susceptible to.

Tell that to Google, which presented a report at Linux Kernel Summit 2018, where 68% from Linux kernel CVEs are caused by C's memory corruption features, and has been pushing for the Kernel Self Preservation Project on Linux.

The videos are freely available.

As for hating C's lack of safety features, it goes back to the earlier 80's from Algol/Pascal/Modula-2/Ada side.

So no, it isn't something new, just now the always on Internet and IoT adoption are making it relatively easier to prove our point.

I think KSP is Kernel Self Protection and Kees Cook has been pushing it since he was the kernel security guy @ Canonical many years ago:

https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr...

Yeah I get it wrong all the time, thanks for the correction.

I only became aware of his work since Google.

All good! He was at Canonical for awhile actually, but did a lot on proactive security and I’ve followed him since. The “SE” in my username is a hat tip to SELinux, as I’ve always been a fan of the Flask Security Architecture.

https://wiki.ubuntu.com/KeesCook

In practice, the key to avoiding logic errors tends to be well-considered interface design.

Not all languages are necessarily equally susceptible to logic errors, though, and C is rather middling in that regard.

We can't stop it, but we can put it in a sandtrap and serialize its access to the outside world.

In what concerns UNIX clones, Oracle did it with Solaris and SPARC ADI, which doesn't have a bright future anyway.

It remains to be seen what ARM and Google will actually do with the new memory extensions.

It remains to be seen what will happen with Fuchsia.

Microsoft is pushing for a mix of .NET Native, modern C++ and Rust.

Apple is still pushing for Swift, although very incrementally.

The big question is how UNIX clones will actually tackle C's unsafety at large, if ever.