Why is the US government telling programmers to move away from C?

The US government's concern is not really about C itself. It is about a kind of bug that C makes easy and that causes a huge share of security holes. Memory safety is the state of being protected from software bugs and vulnerabilities in memory access, such as buffer overflows and dangling pointers. Java is memory-safe because its runtime checks array bounds and pointer dereferences. C, C++ and Fortran allow arbitrary pointer arithmetic with no bounds checking, which makes them memory-unsafe.

A buffer overflow is a bug in which a program writes data beyond the end of a buffer's allocated memory, overwriting whatever lies next to it. The earliest documented hostile use of one was in 1988, as one of several exploits of the Morris worm. And the problem is not rare: in 2019 a Microsoft security engineer reported that 70% of all security vulnerabilities were caused by memory safety issues, and in 2020 a Google team found that 70% of severe security bugs in Chromium had the same cause.

So CISA, the US cybersecurity agency, and the FBI listed it among "bad practices". They call developing new critical-infrastructure product lines in a memory-unsafe language such as C or C++ dangerous when readily available memory-safe languages could be used. For existing products, they say having no published memory safety roadmap is dangerous. But read closely: the guidance is non-binding and imposes no requirement, and the authors acknowledge that migrating takes significant time and resources. CISA and the NSA also published a joint guide on how to adopt memory safe languages.

Rust is one alternative that does not rely on garbage collection. It enforces memory safety without a conventional garbage collector, using a borrow checker that tracks the lifetime of references at compile time. Its creator, Graydon Hoare, reportedly started it out of frustration with an apartment elevator whose software had crashed.