Hardware Podcasts

Memory Safety with Yael Grauer

Oxide and Friends · 14 Feb 2023 · 1h 17m · Episode 5

What this episode covers

Yael Grauer, an investigative journalist and security advocate, discusses her Consumer Reports report on memory safety, explaining how the Pegasus spyware incident highlighted the critical need for memory-safe languages to protect activists and journalists. She details the process of convening industry experts to create a report that advocates for transparency, public accountability, and principles-based regulation rather than rigid rules. The conversation explores how companies like Cloudflare have shifted to Rust and Go after security failures, and Grauer argues for consumer-facing metrics, such as 'nutrition labels' for software, to drive market change. The group also debates the pedagogical challenges of teaching Rust, noting that while it can be learned by beginners, there is a lack of introductory resources, and discusses potential regulatory bodies or incentives to enforce memory safety standards.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
Consumer Reports, NSO Group, Cloudflare, Facebook
Also
Pegasus, Cloudbleed, Rust, Go, C, C++, Android, FTC, CISA, NSA

Related episodes from other shows

Other shows on the same ground, closest first.

  • The Pragmatic Embedded Podcast · 53m

    François Baldassari from Memfault on IoT Observability

    François Baldassari, founder and CEO of Memfault, discusses the evolution of embedded software and the critical need for IoT observability tools. He recounts his experience at Pebble, where a lack of field data led to a severe firmware update bug affecting Android users, which inspired the creation of Memfault's crash reporting and OTA solutions. Baldassari argues that modern embedded teams must adopt agile practices, such as decoupling software from hardware via emulators and implementing 'day 0 updates,' to iterate effectively. He highlights persistent industry challenges, including C language memory management issues, code space constraints, and the emerging crisis of embedded security and privacy.

    Connected products & IoTEmbedded firmware
    8 chapters

  • Embedded.fm · 1h 09m

    67: Software for Things That Can Kill People

    Hosts Chris White and Elecia White discuss the rigorous regulatory processes for safety-critical software, drawing on their experiences with the FAA (DO-178B) and FDA (510k, PMA) for medical devices and avionics. They explain how hazard analysis determines certification levels, the necessity of extensive documentation and traceability, and the tension between agile development and waterfall compliance. The conversation highlights the ethical responsibility of engineers to push back against unsafe deadlines, the use of hardware compartmentalization (FPGAs, voting systems) to ensure safety, and the legal liabilities associated with product failures.

    Certification & complianceMechanical engineering
    8 chapters

  • The Pragmatic Embedded Podcast · 38m

    Luca's interviews and trip report from Embedded World 2024

    Luca and Jeff discuss Luca’s trip to Embedded World 2024, highlighting impromptu interviews with Luka Mustafa, CEO of IRNAS, and Francois Baldassari, CEO of Memfault. They observe that while AI was less dominant than expected, Rust and security were major themes, with Memfault’s platform gaining traction among semiconductor vendors like Nordic and NXP. The conversation also covers Bosch’s successful agile transformation and the industry’s slow but steady shift toward treating software quality as the core of product value.

    Embedded firmwareSecurity & privacy
    6 chapters

  • Coredump Sessions · 1h 03m

    #000: How New IoT Security Regulations Will Shape the Industry's Future

    François Baldassari, founder and CEO of Memfault, and co-founder/CTO Chris Coleman discuss the impact of new IoT security regulations, specifically the EU's Cyber Resilience Act (CRA) and the US FCC's Cyber Trust Mark. They argue that OTA updates, Software Bill of Materials (SBOM) tracking, and device observability are now mandatory for compliance, moving security from an afterthought to a core engineering requirement. The hosts highlight that ignoring these regulations risks severe liability, citing recent pager explosions and Shimano bike shacker hacks as examples of physical dangers from insecure connected devices.

    Security & privacyEmbedded firmware
    9 chapters

  • The Amp Hour · 57m

    Finding Hardware Flaws with Laura Abbott

    Laura Abbott, an engineer at Oxide Computer, discusses her accidental discovery of a buffer overflow vulnerability in the ROM update mechanism of the NXP LPC55S69 microcontroller while working on Oxide's server root of trust. She explains how Oxide is rebuilding the server from the ground up with a focus on hardware security, utilizing their open-source operating system Hubris and the Rust programming language to mitigate risks like memory safety issues. The conversation covers the architecture of the server's secure components, including the service processor and TrustZone-M, as well as the challenges of remote hardware debugging and contributing to the Linux kernel community.

    Security & privacyMicrocontrollers & dev platforms
    6 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Oxide and Friends. The episode itself belongs to its publisher.