#### [Software](/software/)**44** Google says replacing C/C++ in firmware with Rust is easy=========================================================**44** Not so much when trying to convert coding veterans————————————————–[Thomas Claburn](/Author/Thomas-Claburn ‘Read more by this author’) Fri 6 Sep 2024 // 21:44 UTC [](https://www.reddit.com/submit?url=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=Google%20says%20replacing%20C%2fC%2b%2b%20in%20firmware%20with%20Rust%20is%20easy) [](https://twitter.com/intent/tweet?text=Google%20says%20replacing%20C%2fC%2b%2b%20in%20firmware%20with%20Rust%20is%20easy&url=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=Google%20says%20replacing%20C%2fC%2b%2b%20in%20firmware%20with%20Rust%20is%20easy&summary=Not%20so%20much%20when%20trying%20to%20convert%20coding%20veterans) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) Google recently rewrote the firmware for protected virtual machines in its Android Virtualization Framework using the Rust programming language and wants you to do the same, assuming you deal with firmware.In a [write-up](https://security.googleblog.com/2024/09/deploying-rust-in-existing-firmware.html) on Thursday, Android engineers Ivan Lozano and Dominik Maier dig into the technical details of replacing legacy C and C++ code with Rust.’You’ll see how easy it is to boost security with drop-in Rust replacements, and we’ll even demonstrate how the Rust toolchain can handle specialized bare-metal targets,’ said Lozano and Maier. Easy is not a term commonly heard with regard to a programming language known for its [steep learning curve](https://ntietz.com/blog/rust-resources-learning-curve/).  Nor is it easy to get C and C++ developers to see the world with Rust-tinted lenses. Just last week, one of the maintainers of the Rust for Linux project – created to work Rust code into the C-based Linux kernel – [stepped down](https://www.theregister.com/2024/09/02/rust_for_linux_maintainer_steps_down/), citing resistance from Linux kernel developers.’Here’s the thing, you’re not going to force all of us to learn Rust,’ said a Linux kernel contributor during [a lively discussion](https://youtu.be/WiPp9YEBV0Q?feature=shared&t=1720) earlier this year at a conference.* [DARPA suggests turning old C code automatically into Rust — using AI, of course](https://www.theregister.com/2024/08/03/darpa_c_to_rust/)* [LLM-driven C-to-Rust. Not just a good idea, a genie eager to escape](https://www.theregister.com/2024/08/12/opinion_column/)* [How to maintain code for a century: Just add Rust](https://www.theregister.com/2024/07/23/opinion_column/)* [CISA looked at C/C++ projects and found a lot of C/C++ code. Wanna redo any of it in Rust?](https://www.theregister.com/2024/06/28/cisa_open_source/)Nonetheless, Google is encouraging those who are willing to do so. Citing the lack of high-level security mechanisms in firmware, which is often written in memory-unsafe languages such as C or C++, Lozano and Maier argue that Rust provides a way to avoid the memory safety bugs like buffer overflows and use-after-free that account for the majority of significant vulnerabilities in large codebases.’Rust provides a memory-safe alternative to C and C++ with comparable performance and code size,’ they note. ‘Additionally it supports interoperability with C with no overhead.’ The US government lately has been hammering on this theme, with support from leading tech firms and non-profit [initiatives](https://www.memorysafety.org/) to rewrite critical open source projects and components in Rust. Witness the Cybersecurity -& Infrastructure Security Agency [recommendation](https://www.cisa.gov/news-events/news/urgent-need-memory-safety-software-products) last year that software vendors ‘make it a top-level company goal to reduce and eventually eliminate memory safety vulnerabilities from their product lines.’Google was already sold on the idea, having concluded that its Rust developers are [twice as productive](https://www.theregister.com/2024/03/31/rust_google_c/) as its C++ engineers.’We recognize Rust’s critical role in building secure and reliable software at all levels of the stack,’ said Lars Bergstrom, director of engineering for Android Programming Languages at Google and chair of the Board of Directors of the Rust Foundation, in a statement provided to *The Register*.’At Google, we’re increasing Rust’s use across [Android](https://security.googleblog.com/2023/10/bare-metal-rust-in-android.html), [Chromium](https://security.googleblog.com/2023/01/supporting-use-of-rust-in-chromium.html), and more to reduce memory safety vulnerabilities. We’re dedicated to collaborating with the Rust ecosystem to drive its adoption and provide developers with the [resources and training](https://security.googleblog.com/2023/09/scaling-rust-adoption-through-training.html) they need to succeed. This work on bringing Rust to embedded and firmware addresses another critical part of the stack.’ ® [Sponsored: The start of the great virtualization migration?](https://go.theregister.com/tl/3066/shttps://www.theregister.com/2024/08/26/the_start_of_the_great/) Share [](https://www.reddit.com/submit?url=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=Google%20says%20replacing%20C%2fC%2b%2b%20in%20firmware%20with%20Rust%20is%20easy) [](https://twitter.com/intent/tweet?text=Google%20says%20replacing%20C%2fC%2b%2b%20in%20firmware%20with%20Rust%20is%20easy&url=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=Google%20says%20replacing%20C%2fC%2b%2b%20in%20firmware%20with%20Rust%20is%20easy&summary=Not%20so%20much%20when%20trying%20to%20convert%20coding%20veterans) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) #### More about* [Google](/Tag/Google/)* [Government](/Tag/Government/)* [Rust](/Tag/Rust/Programming%20Language/ ‘Disambiguation: Programming Language’) More like these × ### More about* [Google](/Tag/Google/)* [Government](/Tag/Government/)* [Rust](/Tag/Rust/Programming%20Language/ ‘Disambiguation: Programming Language’)* [Security](/Tag/Security/)* [Software](/Tag/Software/) ### Narrower topics* [2FA](/Tag/2FA/)* [AdBlock Plus](/Tag/AdBlock%20Plus/)* [Advanced persistent threat](/Tag/Advanced%20persistent%20threat/)* [Android](/Tag/Android/)* [App](/Tag/App/)* [Application Delivery Controller](/Tag/Application%20Delivery%20Controller/)* [App stores](/Tag/App%20stores/)* [Audacity](/Tag/Audacity/Audio%20Editor/ ‘Disambiguation: Audio Editor’)* [Authentication](/Tag/Authentication/)* [BEC](/Tag/BEC/)* [Black Hat](/Tag/Black%20Hat/)* [BSides](/Tag/BSides/)* [Bug Bounty](/Tag/Bug%20Bounty/)* [CHERI](/Tag/CHERI/)* [Chrome](/Tag/Chrome/)* [Chromium](/Tag/Chromium/Web%20Browser/ ‘Disambiguation: Web Browser’)* [CISO](/Tag/CISO/)* [Common Vulnerability Scoring System](/Tag/Common%20Vulnerability%20Scoring%20System/)* [Confluence](/Tag/Confluence/)* [Cybercrime](/Tag/Cybercrime/)* [Cybersecurity](/Tag/Cybersecurity/)* [Cybersecurity and Infrastructure Security Agency](/Tag/Cybersecurity%20and%20Infrastructure%20Security%20Agency/)* [Cybersecurity Information Sharing Act](/Tag/Cybersecurity%20Information%20Sharing%20Act/)* [Database](/Tag/Database/)* [Data Breach](/Tag/Data%20Breach/)* [Data Protection](/Tag/Data%20Protection/)* [Data Theft](/Tag/Data%20Theft/)* [DDoS](/Tag/DDoS/)* [DEF CON](/Tag/DEF%20CON/)* [Digital certificate](/Tag/Digital%20certificate/)* [Encryption](/Tag/Encryption/)* [Exploit](/Tag/Exploit/)* [Federal government of the United States](/Tag/Federal%20government%20of%20the%20United%20States/)* [Firewall](/Tag/Firewall/)* [FOSDEM](/Tag/FOSDEM/)* [FOSS](/Tag/FOSS/)* [Gemini](/Tag/Gemini/)* [Google AI](/Tag/Google%20AI/)* [Google Cloud Platform](/Tag/Google%20Cloud%20Platform/)* [Google I/O](/Tag/Google%20I%2FO/)* [Google Nest](/Tag/Google%20Nest/)* [Government of the United Kingdom](/Tag/Government%20of%20the%20United%20Kingdom/)* [Grab](/Tag/Grab/)* [Graphics Interchange Format](/Tag/Graphics%20Interchange%20Format/)* [G Suite](/Tag/G%20Suite/)* [Hacker](/Tag/Hacker/)* [Hacking](/Tag/Hacking/)* [Hacktivism](/Tag/Hacktivism/)* [IDE](/Tag/IDE/)* [Identity Theft](/Tag/Identity%20Theft/)* [Incident response](/Tag/Incident%20response/)* [Infosec](/Tag/Infosec/)* [Insider Trading](/Tag/Insider%20Trading/)* [Jenkins](/Tag/Jenkins/)* [Kenna Security](/Tag/Kenna%20Security/)* [Kubernetes](/Tag/Kubernetes/)* [Legacy Technology](/Tag/Legacy%20Technology/)* [LibreOffice](/Tag/LibreOffice/)* [Map](/Tag/Map/)* [Microsoft 365](/Tag/Microsoft%20365/)* [Microsoft Office](/Tag/Microsoft%20Office/)* [Microsoft Teams](/Tag/Microsoft%20Teams/)* [Mobile Device Management](/Tag/Mobile%20Device%20Management/)* [NCSAM](/Tag/NCSAM/)* [NCSC](/Tag/NCSC/)* [OpenOffice](/Tag/OpenOffice/)* [Palo Alto Networks](/Tag/Palo%20Alto%20Networks/)* [Password](/Tag/Password/)* [Phishing](/Tag/Phishing/)* [Pixel](/Tag/Pixel/)* [Privacy Sandbox](/Tag/Privacy%20Sandbox/)* [QR code](/Tag/QR%20code/)* [Quantum key distribution](/Tag/Quantum%20key%20distribution/)* [Ransomware](/Tag/Ransomware/)* [Remote Access Trojan](/Tag/Remote%20Access%20Trojan/)* [Retro computing](/Tag/Retro%20computing/)* [REvil](/Tag/REvil/)* [RSA Conference](/Tag/RSA%20Conference/)* [Software bug](/Tag/Software%20bug/)* [Software License](/Tag/Software%20License/)* [Spamming](/Tag/Spamming/)* [Spyware](/Tag/Spyware/)* [Surveillance](/Tag/Surveillance/)* [Tavis Ormandy](/Tag/Tavis%20Ormandy/)* [Text Editor](/Tag/Text%20Editor/)* [TLS](/Tag/TLS/)* [Trojan](/Tag/Trojan/)* [Trusted Platform Module](/Tag/Trusted%20Platform%20Module/)* [User interface](/Tag/User%20interface/)* [Visual Studio](/Tag/Visual%20Studio/)* [Visual Studio Code](/Tag/Visual%20Studio%20Code/)* [Vulnerability](/Tag/Vulnerability/)* [Wannacry](/Tag/Wannacry/)* [WebAssembly](/Tag/WebAssembly/)* [Web Browser](/Tag/Web%20Browser/)* [WordPress](/Tag/WordPress/)* [Zero trust](/Tag/Zero%20trust/) ### Broader topics* [Alphabet](/Tag/Alphabet/)* [Programming Language](/Tag/Programming%20Language/)* [Search Engine](/Tag/Search%20Engine/)* [Sector](/Tag/Sector/) #### More aboutShare [](https://www.reddit.com/submit?url=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=Google%20says%20replacing%20C%2fC%2b%2b%20in%20firmware%20with%20Rust%20is%20easy) [](https://twitter.com/intent/tweet?text=Google%20says%20replacing%20C%2fC%2b%2b%20in%20firmware%20with%20Rust%20is%20easy&url=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=Google%20says%20replacing%20C%2fC%2b%2b%20in%20firmware%20with%20Rust%20is%20easy&summary=Not%20so%20much%20when%20trying%20to%20convert%20coding%20veterans) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2024/09/06/google_rust_c_code_language/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) **44** COMMENTS #### More about* [Google](/Tag/Google/)* [Government](/Tag/Government/)* [Rust](/Tag/Rust/Programming%20Language/ ‘Disambiguation: Programming Language’) More like these × ### More about* [Google](/Tag/Google/)* [Government](/Tag/Government/)* [Rust](/Tag/Rust/Programming%20Language/ ‘Disambiguation: Programming Language’)* [Security](/Tag/Security/)* [Software](/Tag/Software/) ### Narrower topics* [2FA](/Tag/2FA/)* [AdBlock Plus](/Tag/AdBlock%20Plus/)* [Advanced persistent threat](/Tag/Advanced%20persistent%20threat/)* [Android](/Tag/Android/)* [App](/Tag/App/)* [Application Delivery Controller](/Tag/Application%20Delivery%20Controller/)* [App stores](/Tag/App%20stores/)* [Audacity](/Tag/Audacity/Audio%20Editor/ ‘Disambiguation: Audio Editor’)* [Authentication](/Tag/Authentication/)* [BEC](/Tag/BEC/)* [Black Hat](/Tag/Black%20Hat/)* [BSides](/Tag/BSides/)* [Bug Bounty](/Tag/Bug%20Bounty/)* [CHERI](/Tag/CHERI/)* [Chrome](/Tag/Chrome/)* [Chromium](/Tag/Chromium/Web%20Browser/ ‘Disambiguation: Web Browser’)* [CISO](/Tag/CISO/)* [Common Vulnerability Scoring System](/Tag/Common%20Vulnerability%20Scoring%20System/)* [Confluence](/Tag/Confluence/)* [Cybercrime](/Tag/Cybercrime/)* [Cybersecurity](/Tag/Cybersecurity/)* [Cybersecurity and Infrastructure Security Agency](/Tag/Cybersecurity%20and%20Infrastructure%20Security%20Agency/)* [Cybersecurity Information Sharing Act](/Tag/Cybersecurity%20Information%20Sharing%20Act/)* [Database](/Tag/Database/)* [Data Breach](/Tag/Data%20Breach/)* [Data Protection](/Tag/Data%20Protection/)* [Data Theft](/Tag/Data%20Theft/)* [DDoS](/Tag/DDoS/)* [DEF CON](/Tag/DEF%20CON/)* [Digital certificate](/Tag/Digital%20certificate/)* [Encryption](/Tag/Encryption/)* [Exploit](/Tag/Exploit/)* [Federal government of the United States](/Tag/Federal%20government%20of%20the%20United%20States/)* [Firewall](/Tag/Firewall/)* [FOSDEM](/Tag/FOSDEM/)* [FOSS](/Tag/FOSS/)* [Gemini](/Tag/Gemini/)* [Google AI](/Tag/Google%20AI/)* [Google Cloud Platform](/Tag/Google%20Cloud%20Platform/)* [Google I/O](/Tag/Google%20I%2FO/)* [Google Nest](/Tag/Google%20Nest/)* [Government of the United Kingdom](/Tag/Government%20of%20the%20United%20Kingdom/)* [Grab](/Tag/Grab/)* [Graphics Interchange Format](/Tag/Graphics%20Interchange%20Format/)* [G Suite](/Tag/G%20Suite/)* [Hacker](/Tag/Hacker/)* [Hacking](/Tag/Hacking/)* [Hacktivism](/Tag/Hacktivism/)* [IDE](/Tag/IDE/)* [Identity Theft](/Tag/Identity%20Theft/)* [Incident response](/Tag/Incident%20response/)* [Infosec](/Tag/Infosec/)* [Insider Trading](/Tag/Insider%20Trading/)* [Jenkins](/Tag/Jenkins/)* [Kenna Security](/Tag/Kenna%20Security/)* [Kubernetes](/Tag/Kubernetes/)* [Legacy Technology](/Tag/Legacy%20Technology/)* [LibreOffice](/Tag/LibreOffice/)* [Map](/Tag/Map/)* [Microsoft 365](/Tag/Microsoft%20365/)* [Microsoft Office](/Tag/Microsoft%20Office/)* [Microsoft Teams](/Tag/Microsoft%20Teams/)* [Mobile Device Management](/Tag/Mobile%20Device%20Management/)* [NCSAM](/Tag/NCSAM/)* [NCSC](/Tag/NCSC/)* [OpenOffice](/Tag/OpenOffice/)* [Palo Alto Networks](/Tag/Palo%20Alto%20Networks/)* [Password](/Tag/Password/)* [Phishing](/Tag/Phishing/)* [Pixel](/Tag/Pixel/)* [Privacy Sandbox](/Tag/Privacy%20Sandbox/)* [QR code](/Tag/QR%20code/)* [Quantum key distribution](/Tag/Quantum%20key%20distribution/)* [Ransomware](/Tag/Ransomware/)* [Remote Access Trojan](/Tag/Remote%20Access%20Trojan/)* [Retro computing](/Tag/Retro%20computing/)* [REvil](/Tag/REvil/)* [RSA Conference](/Tag/RSA%20Conference/)* [Software bug](/Tag/Software%20bug/)* [Software License](/Tag/Software%20License/)* [Spamming](/Tag/Spamming/)* [Spyware](/Tag/Spyware/)* [Surveillance](/Tag/Surveillance/)* [Tavis Ormandy](/Tag/Tavis%20Ormandy/)* [Text Editor](/Tag/Text%20Editor/)* [TLS](/Tag/TLS/)* [Trojan](/Tag/Trojan/)* [Trusted Platform Module](/Tag/Trusted%20Platform%20Module/)* [User interface](/Tag/User%20interface/)* [Visual Studio](/Tag/Visual%20Studio/)* [Visual Studio Code](/Tag/Visual%20Studio%20Code/)* [Vulnerability](/Tag/Vulnerability/)* [Wannacry](/Tag/Wannacry/)* [WebAssembly](/Tag/WebAssembly/)* [Web Browser](/Tag/Web%20Browser/)* [WordPress](/Tag/WordPress/)* [Zero trust](/Tag/Zero%20trust/) ### Broader topics* [Alphabet](/Tag/Alphabet/)* [Programming Language](/Tag/Programming%20Language/)* [Search Engine](/Tag/Search%20Engine/)* [Sector](/Tag/Sector/) #### TIP US OFF[Send us news](https://www.theregister.com/Profile/contact/)[#### Rust for Linux maintainer steps down in frustration with ‘nontechnical nonsense’Community seems to C Rust more as a burden than a benefitSoftware5 days -| 178](/2024/09/02/rust_for_linux_maintainer_steps_down/?td=keepreading) [#### Defense AI models ‘a risk to life’ alleges spurned tech firmIn-depth Chatterbox Labs CEO claims Chief Digital and Artificial Intelligence Office unfairly cancelled a contract then accused him of blackmailAI + ML22 hrs -| 4](/2024/09/06/defense_ai_models_risk/?td=keepreading) [#### Rock Chrome hard enough and get paid half a millionGoogle revises Chrome Vulnerability Rewards Program with higher payouts for bug huntersSecurity9 days -|](/2024/08/29/google_chrome_vuln_rewards/?td=keepreading) [#### The start of the great virtualization migration?How consolidating disparate cloud components with Nutanix can bring multiple benefitsSponsored Feature](/2024/08/26/the_start_of_the_great/?td=keepreading) [#### Yelp accuses Google of being a local search bully in antitrust lawsuitChocolate Factory claims rival is trying to revive cases it’s already lostLegal9 days -| 8](/2024/08/29/google_antitrust_yelp/?td=keepreading) [#### Chrome dumped support for Ubuntu 18.04 — but it’ll be backComplaints about lack of notice plus an inquiry from El Reg prompt U-turn by web giantApplications16 days -| 21](/2024/08/22/chrome_dropped_support_for_ubuntu/?td=keepreading) [#### GPT apps fail to disclose data collection, study findsResearchers say that implementing Actions omit privacy details and expose infoAI + ML7 days -| 3](/2024/08/31/gpt_apps_data_collection/?td=keepreading) [#### Digital wallets can allow purchases with stolen credit cardsResearchers find it’s possible to downgrade authentication checks, and shabby token refresh policiesResearch18 days -| 32](/2024/08/20/digital_wallets_simplify_fraud/?td=keepreading) [#### Microsoft hosts a security summit but no press, public allowedop-ed CrowdStrike, other vendors, friendly govt reps…but not anyone who would tell you what happenedSecurity9 days -| 11](/2024/08/28/microsoft_closed_security_summit/?td=keepreading) [#### Deadline looms: Google Workspace mandates OAuth by September 3027 days to get your users’ third-party apps on Google’s sign-inDevops4 days -| 7](/2024/09/03/google_workspace_third_party_apps/?td=keepreading) [#### Google is a monopoly. The fix isn’t obviousComment A business breakup may be coming — but what comes after may not be betterSoftware23 days -| 114](/2024/08/15/google_monopoly_fix/?td=keepreading) [#### Feds, US states sue RealPage for building rent-hiking software for landlordsAlgorithm just a fancy way to collude using private info, prosecutors sayApplications15 days -| 35](/2024/08/23/feds_sue_realpage/?td=keepreading)
Related Tags:
CHROMIUM
Charcoal Typhoon
NAICS: 921 – Executive
Legislative
Other General Government Support
NAICS: 518 – Computing Infrastructure Providers
Data Processing
Web Hosting
Related Services
NAICS: 92 – Public Administration
NAICS: 922 – Justice
Public Order
Safety Activities
NAICS: 51 – Information
TAG-22
Earth Lusca
Associated Indicators: