<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>No,</div><div> it's a "why does anyone use open-source software for critical applications" issue.</div><div><br></div><div>The safety critical industries use C and Ada by and large, but restrict the language to safe subsets,</div><div>- in particular operations like memcpy, or dynamic memory allocation are ruled out</div><div>(google MISRA-C or SParkAda).</div><div><br></div><div>'though I'm sure the nice folks at Galois might have some interesting insights here…</div><div><br></div><div>Andrew Butterfield</div><div><br></div><div>PS - interestinglly, the first down-to-code formal verification of a O/S kernel (google seL4)</div><div>used Haskell as a prototype language and then derived a formal Isabelle/HOL specification</div><div>from that - the code verified was hand-written in C ( a safe subset ).</div><div><br></div><div><br></div><div>Andras Slemmer wrote:<br><blockquote type="cite"><div dir="ltr">Heartbleed is caused by an unchecked memcpy. In particular the size of the memory chunk to be copied is retrieved from a client request and and is not checked<br></div><div class="gmail_extra"><br></div></blockquote><br></div><br><div><div>after Noon Silk <<a href="mailto:noonslists@gmail.com">noonslists@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">it's a "why is anyone still using c!" issue.<div><br></div><div><a href="http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=96db9023b881d7cd9f379b0c154650d6c108e9a3">http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=96db9023b881d7cd9f379b0c154650d6c108e9a3</a><br>
</div><div><br></div><div><br></div></div></blockquote></div><div apple-content-edited="true"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><font class="Apple-style-span" face="Monaco">--------------------------------------------------------------------<br>Andrew Butterfield Tel: +353-1-896-2517 Fax: +353-1-677-2204<br>Lero@TCD, Head of Foundations & Methods Research Group</font></div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><font class="Apple-style-span" face="Monaco">Director of Teaching and Learning - Undergraduate,<br>School of Computer Science and Statistics,<br>Room G.39, O'Reilly Institute, Trinity College, University of Dublin<br> <a href="http://www.scss.tcd.ie/Andrew.Butterfield/">http://www.scss.tcd.ie/Andrew.Butterfield/</a><br>--------------------------------------------------------------------</font></div></div></span></span>
</div>
<br></body></html>