# Memory Safety with Yael Grauer

- Show: [Oxide and Friends](https://hardwarepodcasts.com/podcast/oxide-and-friends)
- Published: 2023-02-14
- Length: 1h 17m
- Episode: 5
- Page: https://hardwarepodcasts.com/podcast/oxide-and-friends/2023-02-14-memory-safety-with-yael-grauer
- Listen: https://share.transistor.fm/s/548eebb2

## Summary

Yael Grauer, an investigative journalist and security advocate, discusses her Consumer Reports report on memory safety, explaining how the Pegasus spyware incident highlighted the critical need for memory-safe languages to protect activists and journalists. She details the process of convening industry experts to create a report that advocates for transparency, public accountability, and principles-based regulation rather than rigid rules. The conversation explores how companies like Cloudflare have shifted to Rust and Go after security failures, and Grauer argues for consumer-facing metrics, such as 'nutrition labels' for software, to drive market change. The group also debates the pedagogical challenges of teaching Rust, noting that while it can be learned by beginners, there is a lack of introductory resources, and discusses potential regulatory bodies or incentives to enforce memory safety standards.

## Chapters

- [0:00](https://hardwarepodcasts.com/podcast/oxide-and-friends/2023-02-14-memory-safety-with-yael-grauer#t=0) Introduction: Yael Grauer and the Consumer Reports Memory Safety Report
- [5:06](https://hardwarepodcasts.com/podcast/oxide-and-friends/2023-02-14-memory-safety-with-yael-grauer#t=306) The Pegasus Incident and the Urgency of Memory Safety
- [13:29](https://hardwarepodcasts.com/podcast/oxide-and-friends/2023-02-14-memory-safety-with-yael-grauer#t=809) Flaws in the CVE Database and Industry Transparency
- [22:54](https://hardwarepodcasts.com/podcast/oxide-and-friends/2023-02-14-memory-safety-with-yael-grauer#t=1374) The Unsafe Language Doom Principle and Private Accountability
- [28:58](https://hardwarepodcasts.com/podcast/oxide-and-friends/2023-02-14-memory-safety-with-yael-grauer#t=1738) Cloudflare's Shift to Rust and Go After Cloudbleed
- [34:34](https://hardwarepodcasts.com/podcast/oxide-and-friends/2023-02-14-memory-safety-with-yael-grauer#t=2074) The Challenge of Metrics, Nutrition Labels, and Gaming Systems
- [45:35](https://hardwarepodcasts.com/podcast/oxide-and-friends/2023-02-14-memory-safety-with-yael-grauer#t=2735) The Historical Shift: Memory Safety Winning the War
- [53:52](https://hardwarepodcasts.com/podcast/oxide-and-friends/2023-02-14-memory-safety-with-yael-grauer#t=3232) Teaching Rust: First Language vs. Experienced Developer
- [1:01:31](https://hardwarepodcasts.com/podcast/oxide-and-friends/2023-02-14-memory-safety-with-yael-grauer#t=3691) Regulatory Solutions: NTSB Equivalents and Shareholder Action

## Topics

- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Microcontrollers & dev platforms](https://hardwarepodcasts.com/topic/microcontrollers-and-platforms)
- [Policy, trade & tariffs](https://hardwarepodcasts.com/topic/policy-trade-and-tariffs)
- [Careers & education](https://hardwarepodcasts.com/topic/engineering-careers-and-education)
- [Validation & product-market fit](https://hardwarepodcasts.com/topic/validation-and-product-market-fit)

## Most relevant to

early-stage companies

## Mentioned

- Consumer Reports (company)
- Pegasus (other)
- NSO Group (company)
- Cloudflare (company)
- Cloudbleed (other)
- Rust (other)
- Go (other)
- C (other)
- C++ (other)
- Android (other)
- Facebook (company)
- FTC (other)
- CISA (other)
- NSA (other)

## Related episodes from other shows

- [François Baldassari from Memfault on IoT Observability](https://hardwarepodcasts.com/podcast/the-pragmatic-embedded-podcast/2023-02-15-francois-baldassari-from-memfault-on-iot-observability) (The Pragmatic Embedded Podcast)
- [67: Software for Things That Can Kill People](https://hardwarepodcasts.com/podcast/embedded-fm/2014-09-11-67-software-for-things-that-can-kill-people) (Embedded.fm)
- [Luca's interviews and trip report from Embedded World 2024](https://hardwarepodcasts.com/podcast/the-pragmatic-embedded-podcast/2024-08-21-lucas-interviews-and-trip-report-from-embedded-world-2024) (The Pragmatic Embedded Podcast)
- [#000: How New IoT Security Regulations Will Shape the Industry's Future](https://hardwarepodcasts.com/podcast/coredump-sessions/2024-09-17-000-how-new-iot-security-regulations-will-shape-the-industrys-future) (Coredump Sessions)
- [Finding Hardware Flaws with Laura Abbott](https://hardwarepodcasts.com/podcast/the-amp-hour/2022-05-23-finding-hardware-flaws-with-laura-abbott) (The Amp Hour)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/oxide-and-friends/2023-02-14-memory-safety-with-yael-grauer. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Oxide and Friends.