Let's look at Heartbleed first.
There was a rather foul flaw found in OpenSSL, after Heartbleed the Linux Foundation collected a lot of money to help work on core infrastructure projects. If we look at the state of things it basically hasn't changed outside of money moving around. OpenSSL cannot be fixed for a number of reason.
- Old codebase
- Backward compatibility
- Difficult API
- It is "general purpose"
The reality is that the only way to get what could be considered a safe library, you would have to throw everything out and start over with some very specific ideas in mind. Things like sun-setting algorithms didn't exist when OpenSSL was created. There is no way you're going to get even a small number of projects to move from using OpenSSL to some new "better" library. It would have to be so much better they couldn't ignore it. As anyone who has ever written software knows, you don't build a library like that over night. I think 5 years would be a conservative estimate for double digit adoption rates.
While I'm picking on OpenSSL here, the story is the same in virtually every library and application that exists. OpenSSL isn't special, it just gets a lot of attention.
Let's think about glibc.
Glibc is the C library used by most Linux distributions. If the Kernel is the heart, glibc is the soul. Nothing can even exist without this library. Glibc even strives to be POSIX compliant, for good reason. POSIX has given us years of compatibility and cooperation.
Glibc probably has plenty more horrible bugs hiding in the code. It's wicked complex and really large. If you ever need some nightmare fuel, look at the glibc source code. Everything we do in C relies on a libc being around, glibc doesn't have that luxury.
Replacing libc is probably out of the question, it's just not something practical. So let's think about something like golang. What if everything was written using golang? It's not totally insane, there are substantial benefits. It's not as fast as C though, that will be the argument most use. Golang will probably never beat C, the things that makes it safer also makes it slower. But now if we think about replacing UNIX utilities with golang, why would we want to do that? Why not throw out all the mistakes UNIX made and do something else?
Now we're back to the legacy and compatibility arguments. Linux has more than twenty years of effort put into it. You can't just replace that. Even if you had the best team in the world I bet 10 years would be wishful thinking for having half the existing features.
So what does this mean? It means we don't know where to start yet. We are trying to solve our problems using what we know and the tools that exist. We have to solve this using new tools and new thinking. The way we fix security is by doing something nobody has ever thought of before. In 1920 the concept of the Internet didn't exist, people couldn't imagine how to even solve some of the problems we can easily solve using it. Don't try to solve our problems with what you know. Solve the problems using new ideas, find out what you don't know, that's where the solution lives.