Why isn’t Vista Written in .NET?

Gary McGraw, CTO of Cigital Inc., has written this article with some insight on why Vista isn’t written using .NET.

The problem, it turns out, is that the .NET builders did not give much thought to providing many of the essential basic building blocks that operating systems construction crews need for their work. Interpreted code has some minor performance issues as well (note that there are many ways to overcome this often overly shrill critique). But the main problem was that the Microsoft OS guys are big C++ users.

Interpreted languages such as .NET and Java before it provide some great advantages when it comes to writing secure less hackable operating systems:

• type safety: making sure that an integer is an integer, and not a bag of overwritten memory masquerading as an integer
• intelligent memory handling: so that nifty things like overflowed arrays are no longer possible
• a layered security model: so that each application / process / thread only has access to what it should

Too bad, it looks like we’ll have to wait yet another generation of operating system (or three) for programming languages and lazy programmers to stop being the main threat to system security.