Apple rewrote their C-based TrueType hinting interpreter in memory-safe Swift for the Fall 2025 releases. Not only did they kill a major security attack surface, they landed 13% faster using Swift 6 features like ~𝐶𝑜𝑝𝑦𝑎𝑏𝑙𝑒 and 𝑆𝑝𝑎𝑛.
🔗: https://www.swift.org/blog/migrating-truetype-hinting-to-swift/ by Scott Perry (@numist)
#Swift #MemorySafety #Apple
Swift at Apple: Migrating the TrueType Hinting Interpreter
TrueType is a widely used vector font standard for rendering text in web pages, PDFs, operating systems, and applications. Familiar fonts like Helvetica, Garamond, and Monaco are all built on TrueType outlines. The format specifies a hinting interpreter intended to help outlines rasterize faithfully on low-resolution displays. Modern high-resolution displays enable beautiful typography from outlines alone, but TrueType fonts that need hinting to render legibly remain in use and we continue to support them.
Font parsers process data from untrusted sources, making the TrueType hinting interpreter a security-critical attack surface. To make the format more resilient on Apple platforms, we rewrote its hinting interpreter from C to memory-safe Swift for the Fall 2025 releases. In addition to memory safety, we also improved performance: on average, our Swift interpreter runs 13% faster than the C interpreter it replaced.
To accompany this post, we’ve also published the source code of the Swift TrueType hinting interpreter. We hope sharing our experience helps others doing similar work in Swift.
Oh, look! Another riveting blog post dissecting the glaringly obvious:
#Rust doesn't serve memory safety CVEs on a silver platter like C/C++. 🎉 We all needed a 2026 update on how not to write exploit-prone code, because that's as timeless as memes from 2010. 🍾🤦♂️
https://kobzol.github.io/rust/2026/06/15/how-memory-safety-cves-differ-between-rust-and-c-cpp.html #MemorySafety #CPlusPlus #ExploitPrevention #CodingBestPractices #BlogPost #Humor #HackerNews #ngatedHow memory safety CVEs differ between Rust and C/C++
CVE is a database used for categorizing and reporting security vulnerabilities in software. There are various kinds of vulnerabilities that can be reported. Some of them are caused simply by bugs in the program logic (like a recent CVE reported in Cargo), but some of the most nasty ones are caused by memory unsafety, which can easily lead to exploits. In this post I want to focus on the latter kind of CVEs, how they are reported, especially in libraries, and how it differs between Rust and C or C++.
How memory safety CVEs differ between Rust and C/C++
CVE is a database used for categorizing and reporting security vulnerabilities in software. There are various kinds of vulnerabilities that can be reported. Some of them are caused simply by bugs in the program logic (like a recent CVE reported in Cargo), but some of the most nasty ones are caused by memory unsafety, which can easily lead to exploits. In this post I want to focus on the latter kind of CVEs, how they are reported, especially in libraries, and how it differs between Rust and C or C++.
Check out "Low Level Software Security for Compiler Developers", an open source book. Looks good, systematic - not only for compiler developers but anyone interested in infosec and cyber. I wished I had known this last time I was asked about practical resources that discuss
#memorysafety https://llsoftsec.github.io/llsoftsecbook/LLSoftSecBook.pdfdepthfirst’s AI agent found 21 FFmpeg zero-days (MEDIUM, CVE-2026-39210 – 39218), mainly heap/stack overflows — oldest since 2003. No active exploitation. Patches rolling out. Update ASAP.
https://radar.offseq.com/threat/depthfirsts-ai-agent-found-21-ffmpeg-zero-days-cve-99cb219d #OffSeq #FFmpeg #AI #MemorySafetyThe Fil-C Optimized Calling Convention
Improving C# Memory Safety - .NET Blog
The `unsafe` keyword is being redesigned to mark caller-facing contracts rather than just syntax. Safety obligations between callers and callees become visible and reviewable. The model is motivated by the rise of AI-assisted code generation and arrives as a preview in .NET 11.
Improving C# Memory Safety - .NET Blog
The `unsafe` keyword is being redesigned to mark caller-facing contracts rather than just syntax. Safety obligations between callers and callees become visible and reviewable. The model is motivated by the rise of AI-assisted code generation and arrives as a preview in .NET 11.
Snapp iOS Weekly
N-gated Hacker News
Hacker News
burakemir
OffSequence
रञ्जित (Ranjit Mathew)
Barret
Brandon H 
