You're right that many languages do not write to the memory spaces when they're free'd. For languages that don't, like C and C++, the langauges expect that if the programmer needs it, the programmer will do this manually.
http://stackoverflow.com/questions/1287180/why-doesnt-free-zero-out-the-memory-prior-to-releasing-ithttps://stackoverflow.com/questions/1287180/why-doesnt-free-zero-out-the-memory-prior-to-releasing-it
If you're developing in one of these languages, you should use a library which does the work for you. There are libraries which will even do garbage collection and provide other "high level" features. The bonus here is that if you're in a tight spot for performance, you can turn it off to tweak manually.
That said, I agree with some of the other posts, that these low level languages are often overused, but not haphazardly:
- Security holes exist in high level languages too,
- Performance is a real concern which could affect your competitiveness in the marketplace
- Your existing codebase is a big investment. Many of these languages weren't mature when your software was being initially developed.
- You shouldn't assume that just because your existing codebase was written in a low level language, that your security practices are lax and your code is insecure.
Security is risk management. If the cost of re-writing your code in a different language might bankrupt you, the new language doesn't even have any guarantees of security, and the probability of occurrence of a major, unpatchable security hole is extremely low, then it's clear that the act of rewriting your application in a "more secure" language is only going to increase your risks.
