4 ms·

Thanks for clarification. So the key of the hacking is a hardware simulation bug within VMware. It is not a surprise to exploit the security holes in Edge at a

• alanbernstein 10y ago
  I think the key is having all three at once?
  • samat 10y ago
    The last vm escape is very impressive at its own.
• platinumrad 10y ago
  Edge isn't nearly the security nightmare that Internet Explorer was and runs sandboxed in a similar manner as Chrome so you shouldn't underestimate the impressiveness of that first escape either.
  • greggman 10y ago
    not even close. Just look at the CVE listings for 2016 Chrome vs Edge. Edge: 74 code execution vulnerabilities, Chrome: 2
    • oceanswave 10y ago
      Given that Chrome runs on many platforms, and Edge one, it makes this even more sobering
    • staticassertion 10y ago
      CVE listings are not a meaningful metric at all for security. What that could reflect is that Edge's bounty program is far more popular than Chrome's. It could mean that Edge is willing to hand out CVEs for uncomfirmed bugs whereas Chrome requires further proof (I am not saying this is the case at all, to be clear).
      • tapirl 10y ago
        Are there any reasons Edge won't go open source? Avoid too many bugs been found?
        • staticassertion 10y ago
          You think that Edge is closed source to avoid more bugs being found, but Microsoft also pays 3rd party developers for finding bugs in Edge?
          • tapirl 10y ago
            You didn't answer my question at all. Are there any special reasons Edge has not been open sourced yet?
            • staticassertion 10y ago
              I didn't really understand what your question was, it sounded as if you were trying to imply the reason yourself. I do not work for Microsoft, I have no insight into their decision making process. I doubt it has to do with security.
        • repples 10y ago
          The JavaScript engine is open source: https://github.com/Microsoft/ChakraCore https://github.com/Microsoft/ChakraCore
      • greggman 10y ago
        If.you have another metric please offer it. I have no reason to believe the metrics are biased. A similar number of issues appear for all browsers . The difference is the type of issue. Of course you're free to just take it on faith that Edge is more secure because Microsoft says so and that the CVE listings have no purpose being used as a comparison. But for me, without finding some other metric to compare by I'll use this metric until there's a better replacement
        • 10y ago
• rspeer 10y ago
  This may not fit your preconceptions, but the article is saying that Edge is considered a difficult target for hacking.
  • oceanswave 10y ago
    Which is a strange preconception for the article to have given https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/year-2016/opec-1/Google-Chrome.html https://www.cvedetails.com/vulnerability-list/vendor_id-1224... vs https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-32367/year-2016/opec-1/Microsoft-Edge.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p...
    • staticassertion 10y ago
      As I said above, CVE listings are a useless metric for measuring safety of a product. High # of CVEs can easily indicate a safer product with a more mature bug bounty program or an attitude of "Assume it's vulnerable, don't require full exploits to prove it". There is no good information to be drawn from those two links.
    • deleted 10y ago
      [deleted]
    • deleted 10y ago
      [deleted]