4 ms·

I would bet 99% of that 3/4 (or at least the part written in C) could have been caught with testing, fuzzing, and sanitizers we have today.

by nsajko 7y ago

littlestymaar 7y ago
Too bad neither Microsoft, Google or Apple ever heard about those tools…
- z3phyr 7y ago
  Is there a stat on how much % of CVE directly pertains to Microsoft, Google or Apple products?
  - testvox 7y ago
    You could easily calculate such a stat from here. Microsoft Apple and Google are all in the top 5, with IBM and Oracle being the other two. Adobe used to be on top but with the death of flash they have been slipping. I checked out the breakdown of memory corruption/overflow bugs and its well over 50% of CVEs for MS and Apple. Google is much better with less then a quarter of their CVEs being memory related. https://www.cvedetails.com/top-50-vendors.php https://www.cvedetails.com/top-50-vendors.php Microsoft 6508/116769 = 5.5% Apple 4502/116769 = 3.8% Google 4110/116769 = 3.5% total (6508 + 4502 + 4110)/116769 = 13%
    - bluejekyll 7y ago
      Microsoft's own research on this area claims it's closer to 70%: https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se...
      - littlestymaar 7y ago
        You're not talking about the same thing: the ggp asked how many CVE were dedicated to Apple, Microsoft or Google products (a question that doesn't make much sense here, but the gp still went on the calculation). You are talking about which proportions of thoses big corps CVE are memory-related (which is the right question to ask in this context, but not the one asked…).
- pjmlp 7y ago
  Or even Linux, with its strict patch process, still managed to have 68% of 2018's kernel CVEs, related to memory corruption issues due to C's use.
  - deleted 7y ago
    [deleted]
pjmlp 7y ago
Last JetBrains questionnaire proves, once again, how little most devs care about them. "Which of the following tools do you or your team use for guideline enforcement or other code quality/analysis?" https://www.jetbrains.com/lp/devecosystem-2019/cpp/ https://www.jetbrains.com/lp/devecosystem-2019/cpp/
deleted 7y ago
[deleted]
MaxBarraclough 7y ago
There's a lot of value in those tools, but it's better to entirely eliminate the family of bugs 'by construction'.

I would bet 99% of that 3/4 (or at least the part written in C) could have been caught with testing, fuzzing, and sanitizers we have today.

by nsajko 7y ago

I would bet 99% of that 3/4 (or at least the part written in C) could have been caught with testing, fuzzing, and sanitizers we have today.

littlestymaar 7y ago

Too bad neither Microsoft, Google or Apple ever heard about those tools…

z3phyr 7y ago
Is there a stat on how much % of CVE directly pertains to Microsoft, Google or Apple products?
- testvox 7y ago
  You could easily calculate such a stat from here. Microsoft Apple and Google are all in the top 5, with IBM and Oracle being the other two. Adobe used to be on top but with the death of flash they have been slipping. I checked out the breakdown of memory corruption/overflow bugs and its well over 50% of CVEs for MS and Apple. Google is much better with less then a quarter of their CVEs being memory related. https://www.cvedetails.com/top-50-vendors.php https://www.cvedetails.com/top-50-vendors.php Microsoft 6508/116769 = 5.5% Apple 4502/116769 = 3.8% Google 4110/116769 = 3.5% total (6508 + 4502 + 4110)/116769 = 13%
  - bluejekyll 7y ago
    Microsoft's own research on this area claims it's closer to 70%: https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se...
    - littlestymaar 7y ago
      You're not talking about the same thing: the ggp asked how many CVE were dedicated to Apple, Microsoft or Google products (a question that doesn't make much sense here, but the gp still went on the calculation). You are talking about which proportions of thoses big corps CVE are memory-related (which is the right question to ask in this context, but not the one asked…).
pjmlp 7y ago
Or even Linux, with its strict patch process, still managed to have 68% of 2018's kernel CVEs, related to memory corruption issues due to C's use.
- deleted 7y ago
  [deleted]

pjmlp 7y ago

Last JetBrains questionnaire proves, once again, how little most devs care about them. "Which of the following tools do you or your team use for guideline enforcement or other code quality/analysis?" https://www.jetbrains.com/lp/devecosystem-2019/cpp/ https://www.jetbrains.com/lp/devecosystem-2019/cpp/

deleted 7y ago

[deleted]

MaxBarraclough 7y ago

There's a lot of value in those tools, but it's better to entirely eliminate the family of bugs 'by construction'.