1October 3, 2023 2 Libraries: A First Step Toward Standard C++ Dependency Management Bret Brown, C++ Infrastructure Lead, Bloomberg Bill Hoffman, CTO, KitwareHello! Welcome! Bret Brown C++ Infrastructure portable as the code they contain! ● ✓ Projects should be “cattle,” not “pets”! 7Why dependency management? 8Consensus: Managing dependencies == way too hard Q: Which of these do you find frustrating names: jsonlogConfig.cmake Jsonlog-config.cmake # ... CMake gives you some dependency management tips here ... 13 Aside: Coloring and bolding added for emphasisMotivation: What would we design

Orthogonality In Design cppcon 2021 Either you keep self improving, or it's time to move into management. --Niall Douglas 30-Sep-2021 https://old.reddit.com/r/cpp/comments/pye3iv/c_commi ttee_dont Orthogonality In Design cppcon 2021 Symmetry In C++ Code • C++’s most common symmetry example: Resource Management ... { Bar b; //...do stuff with b } Enter the block, object is created Leave the block, Orthogonality In Design cppcon 2021 Symmetry In C++ Code • C++’s most common symmetry example: Resource Management ... { Bar b; //...do stuff with b } Enter the block, object is created Leave the block,

transitive dependencies; building them all manually is a pain • Licensing issues; need to minimize legal risk (covered later in this talk) • Fears of potential security vulnerabilities (covered later in this cachingProblem 6: Security vulnerabilities in open-source code •Introduction of security vulnerabilities is a risk of consuming open-source • OpenSSL Heartbleed (2014) • OpenSSL email address buffer overflow (2022) cost to maintain dependencies Solution 7: Centralize dependency management processes •Companies are centralizing common dependency management tasks •Maintaining 3rd party packages and providing support

alternative pointer-based data management model to the buffer/accessor mode ○ Unified virtual address space (consistent pointers) ○ Pointer-based structures ○ Explicit memory management ○ Shared memory allocations unreasonable risk caused by malfunction => Risk has been analyzed, mitigated to a reasonable level, provenACHIEVING FUNCTIONAL SAFETY For software: – Follow defined processes • Requirements management • Design

you to warehouse risk - Avoid big lossesMarket Making – A Losers’ game 9 • Be in the market at all times - Make small profits from the premium investors pay for you to warehouse risk - Avoid big losses TCP/UDP stack - Reduced set of features • EF_VI - Layer 2 API: interface, buffers and memory management (similar to DPDK) - Lowest latency onload --profile=latency ./algo_trader Source: solarflare involved in any operations - Multi processes requires it – which is good for minimizing operational risk74 Shared Memory • Why shared memory - If you don’t need sockets, no need to pay for their complexity

o Even the compiler needs to be verified! • Software Bill of Materials (SBOM) o Vulnerability management o Compliance and reporting o Supply chain transparency • Cybersecurity Bill of Materials (CBOM) then? 24 Explore Tooling Processes Architecture CultureArchitecture 25Control and reduce risk Risk Driven Architecture 26 SW System/Item (Class C) SW Item X (Class C) SW Item Y (Class B) Physical/Logical Segregation? Reduce Coupling & Enhance CohesionSafety Critical Path vs Non-Real Time Domain Risk Driven Architecture 27 SW System/Item (Class C) SW Item X (Class C) SW Item Y (Class B)

possible behaviors of your system will occur.” - Hyrum's law (modi�ed)14 Aurora Innovation Testing as risk mitigation If every code change can break our software, how could we stay productive and safely Output may miss important data. Reliability Output may include nondeterministic data. Data Management Output is stored in version control along with source code. Reporting Differences are dif�cult ********************** 901 61797 09/15/2023 05:46 PM23 Aurora Innovation Problem: Data Management Good test systems enable auditing how software evolves.24 Aurora Innovation Problem: Reporting

SYCL 2020 Hello WorldIn SYCL there are two memory management models; buffers and USM - here we will focus on buffers The buffers memory management model separates the storage and access of data and and automatically handles data dependencies USM provides a more explicit memory management #include int main(int argc, char *argv[]) { std::vector dA{ … }, dB{ … }, dO{ … (sycl::exception &e) { /* handle SYCL exception */ } } 29 SYCL 2020 Hello WorldIn the buffers memory management model there are buffers and accessors A buffer manage data across the host and one or more

inherently complex. A single mistake can be devastating. Solutions should be simple to reduce the risk of mistakes.Max Hoffmann Security Beyond Memory Safety CppCon 2024 24 Right Wrong Make the right Hoffmann Security Beyond Memory Safety CppCon 2024 28 Secure Coding Attacker Model Vulnerability Management Security RequirementsMax Hoffmann Security Beyond Memory Safety CppCon 2024 29 My Bias: Embedded