4 ms·

Well, that's not really a fair interpretation of my argument, I'd say. My argument is: * We have a production, widely used codebase * This codebase is in C++

Well, that's not really a fair interpretation of my argument, I'd say. My argument is: * We have a production, widely used codebase * This codebase is in C++ * This codebase has probably the most significant efforts to secure it of anything of its size, or at least it's in the top 5 * This codebase suffered enouguh critical vulnerabilities for users to be attacked in the wild So let's be clear - Chrome suffers from thousands of memory safety vulnerabilities, but not many make it to ITW exploits. This case is special because users actually suffered because of it. It isn't fair to say they've had "one security issue", certainly, just one that's had major user impact. I'm not judging C++ or the choice to use it. I am saying that this is an example of a very hardened system not being able to compensate for memory unsafety.

est31 8y ago
> not being able to compensate for memory unsafety. This is a bit of a simplistic view tbh. They have managed to drive up costs for 0 days on the black market. They have introduced auto-updating browsers to get security patches to users quickly. They have managed to reduce the number of security exploits. This is a big feat and major progress. They have compensated for memory unsafety quite effectively. Maybe not perfectly, but well enough. Yes, memory safe languages are wonderful. I myself am a rustacean and LOVE to RIIR. But their efforts weren't in vain. Should they start thinking about adopting a memory safe language like Rust or Wuffs? Definitely.
- staticassertion 8y ago
  > This is a bit of a simplistic view tbh. It's a very literal one. I think I've been very open about what an accomplishment they've made, and how proud they should be to have kept Chrome users safe for all of these years. It is exactly because their efforts to secure Chrome are so impressive that I think this event is interesting. None of what I've said is about Rust or even a suggestion that they shouldn't keep doing what their doing. One ITW exploit in a lifetime of a product is a great track record. It is merely interesting to observe when herculean efforts fall down.

est31 8y ago

> not being able to compensate for memory unsafety. This is a bit of a simplistic view tbh. They have managed to drive up costs for 0 days on the black market. They have introduced auto-updating browsers to get security patches to users quickly. They have managed to reduce the number of security exploits. This is a big feat and major progress. They have compensated for memory unsafety quite effectively. Maybe not perfectly, but well enough. Yes, memory safe languages are wonderful. I myself am a rustacean and LOVE to RIIR. But their efforts weren't in vain. Should they start thinking about adopting a memory safe language like Rust or Wuffs? Definitely.

staticassertion 8y ago
> This is a bit of a simplistic view tbh. It's a very literal one. I think I've been very open about what an accomplishment they've made, and how proud they should be to have kept Chrome users safe for all of these years. It is exactly because their efforts to secure Chrome are so impressive that I think this event is interesting. None of what I've said is about Rust or even a suggestion that they shouldn't keep doing what their doing. One ITW exploit in a lifetime of a product is a great track record. It is merely interesting to observe when herculean efforts fall down.