With C++ blamed for CrowdStrike calamity, an ex-DE Shaw researcher has an answer
What went wrong at CrowdStrike? Aside from an apparently woeful lack of testing before releasing an update to what CrowdStrike itself says were 8.5m devices globally, the issue seems to have been linked to the complexities of C++.
Get Morning Coffee ☕ in your inbox. Sign up here.
Engineers across the internet spent the weekend Tweeting opinions like that below, suggesting that CrowdStrike's issue apparently came from a "null pointer" in which a C++ programmer at CrowdStrike accidentally told the program to refer to an invalid region of memory, resulting in the program being aborted by Windows.
While there is some debate whether this is really what happened (it may have instead been due to a discrepancy between synthetic test data and actual data, for example) the null pointer suggestion has rekindled complaints about C++'s complexity and reinvigorated suggestions that it should really be replaced with Rust, which has a "bulletproof" compiler. Bill Buchanan, a professor of applied cryptography at Edinburgh Napier University noted, for example, that his students have always struggled to understand pointers and that "Overall, C and C++ are often a recipe for disaster for those who are not experienced in understanding how variables are allocated in memory."
This is where Sean Baxter, a former scientific programmer at DE Shaw Research, has a potential answer. Baxter, who spent two years at hedge fund DE Shaw's Research arm and three years at NASA, appears to have spent the past eight years or so working on a method of creating "safe code in C++." Visible here and here, it's called "Circle C++ for memory safety." Baxter says his intention is to create a "superset of C++ with a safe subset" that's as safe as Rust but has "unbeatable interoperability with your existing [C++] code."
Baxter didn't respond to our attempt to contact him for this article, but he did spend the weekend tweeting about how the implementation of his safe code might have prevented the alleged CrowdStrike problem.
Bryce Elder, principal architect at NVIDIA and a C++ Library Evolution chair emeritus, seemed to share the perception that C++ was the issue, but Elder said this is only part of the problem: "Adding a borrow checker or similar for C++ or switching to Rust protects code written in the future. But the issue with C++ isn't future code, it's the billions of lines of existing code," Elder observed....
Crowdstrike Analysis:
It was a NULL pointer from the memory unsafe C++ language.
Since I am a professional C++ programmer, let me decode this stack trace dump for you. pic.twitter.com/uUkXB2A8rm— Zach Vorhies / Google Whistleblower (@Perpetualmaniac) July 19, 2024
Have a confidential story, tip, or comment you’d like to share? Contact: +44 7537 182250 (SMS, Whatsapp or voicemail). Telegram: @SarahButcher. Click here to fill in our anonymous form, or email editortips@efinancialcareers.com. Signal also available.
Bear with us if you leave a comment at the bottom of this article: all our comments are moderated by human beings. Sometimes these humans might be asleep, or away from their desks, so it may take a while for your comment to appear. Eventually it will – unless it’s offensive or libelous (in which case it won’t.)
