{"id":119948,"date":"2024-09-26T15:43:01","date_gmt":"2024-09-26T13:43:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/metody-bezopasnoj-raboty-s-pamyatyu-pozvolili-sushhestvenno-snizit-chislo-uyazvimostej-v-android"},"modified":"2024-09-26T15:43:01","modified_gmt":"2024-09-26T13:43:03","slug":"metody-bezopasnoj-raboty-s-pamyatyu-pozvolili-sushhestvenno-snizit-chislo-uyazvimostej-v-android","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/metody-bezopasnoj-raboty-s-pamyatyu-pozvolili-sushhestvenno-snizit-chislo-uyazvimostej-v-android","title":{"rendered":"Memory safety methods significantly reduced the number of vulnerabilities in Android","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Google has summarized the results of its initiative to implement safe coding practices in Android, such as the use of programming languages that ensure safe memory operations, the application of static analyzers, and designing APIs with security in mind. The changes have reduced the share of memory-related vulnerabilities in Android from 76% in 2019 to 24% in 2024, which is significantly lower than the industry average of 70%. <\/p>\n

Google engineers also concluded that the main source of security problems is new code, and therefore attention should be focused on modernizing the methods for developing new code. Existing code gradually becomes more vetted and secure (there is an exponential dependence of security on time), making investments in rewriting existing code less advantageous. For example, 5-year-old code on average has a vulnerability density 3.4 times lower than that of new code. For Android and Chromium projects, the implementation of safe memory practices results in a difference of 7.4 times.

\"Memory<\/center> <\/p>\n

Thus, if memory errors in new code are prevented, similar errors in old code will be identified less and less over time. In general, Google recommends not rewriting old code but focusing on writing new code in languages that safely manage memory and ensuring interoperability between new and old code. <\/p>\n

In addition to reducing the number of vulnerabilities, the use of safe programming methods improves development productivity, leads to higher code quality, and positively impacts performance. For example, rewriting QR code generation code in Chromium using Rust has resulted in a 95% performance increase by eliminating overhead associated with the need for additional sandbox isolation. <\/p>\n

The speed and quality of development are increasing due to simplified testing and the shifting of bug detection to the early stages of development, where issues become apparent before the developer begins reviewing the code. For example, the rollback metrics show that, for Rust code, the number of rollbacks due to unforeseen errors is twice as low as that for C++ code. <\/p>\n

In general, the application of secure programming methods is presented as the most effective development paradigm today, replacing the three approaches previously used: <\/p>\n