4 ms·
> None is better at security architecture and design than Microsoft This is an interesting claim; most of what I (and probably most people) think about Microso
by jimrandomh 10y ago
> None is better at security architecture and design than Microsoft
This is an interesting claim; most of what I (and probably most people) think about Microsoft software security is informed by its earlier history, where it was doing pretty badly overall. What has Microsoft been up to lately that's impressed you with their security architecture/design?
- tptacek 10y agoWhen Microsoft's platform code was notably weak, pretty much everyone else's was too. There was a time when they were maybe 2-3 years behind the state of the art on Unix servers, but the state of the art at the time wasn't good, and that time is mostly past. For something like 10 years, Microsoft's been punching their weight with secure runtimes in particular, especially given the handicap they work with due to compatibility requirements. They're not perfect. But nobody is. Here's a good recent example: https://medium.com/@justin.schuh/securing-browsers-through-isolation-versus-mitigation-15f0baced2c2#.24fivh6ht https://medium.com/@justin.schuh/securing-browsers-through-i...
- nsgi 10y agoHow does this compare to Google pioneering security architecture in Chrome, which gave it a strong record in Pwn2Own, and eventually became the basis for security in other browsers, including Edge?
- tptacek 10y agoNot sure what you're looking to hear from me. By a nose, I think Google has the best security team in the industry.
- jimbobimbo 10y agoThis is a valid claim, due to the history of SDL: http://www.techworld.com/news/security/greatest-security-story-never-told-how-microsofts-sdl-saved-windows-3505545/ http://www.techworld.com/news/security/greatest-security-sto...