4 ms·

Counter counter point: SQL injections and buffer overflows now require nearly intentional effort to introduce into a codebase, whereas they used to be the defau

Counter counter point: SQL injections and buffer overflows now require nearly intentional effort to introduce into a codebase, whereas they used to be the default. The question is: when we find a common class of vulnerability, what's the best way to deal with it?

tptacek 7y ago
We find SQLI regularly. We don't find buffer overflows very often! That bug class has been mitigated. It's better to eliminate bug classes, and memory safety is a good idea. But it's a good idea we've had in mainstream software engineering for coming up on 2 decades, and your default assumption about any piece of software should still be that it harbors grave vulnerabilities.
- mrkeen 7y ago
  Yes. Buffer overflows were mitigated at the language level. We use languages instead of 'just bytes'.
  - tptacek 7y ago
    Buffer overflows are best mitigated at the language level. Other vulnerabilities aren't.