3 ms·

The bug has existed since 2003, software development practices and tools, such as code review and pull requests have come a long way since then. I find it hard

The bug has existed since 2003, software development practices and tools, such as code review and pull requests have come a long way since then. I find it hard to remember what it was like doing development work at my first job in "the bank" back in 2011. 2003 must have been another world.

hyperman1 6y ago
In the general world i'd agree with you. But microsoft was at that point still at the forefront of software dev. They had build servers etc... They knew about best practices from IBM, including code reviews. What changed was the internet. Before that, say until 1998, they could deliver shoddy code without much impact, and the underpowered machines required cutting a few corners. But it saddled them with a legacy of horrible code. But they know better now. I'd expect them to audit code as critical as this somewhere between 2003 and now. Also, integer overflows are something the processor could protect against. See e.g. the 'into' x86 insn. It got dropped because disinterest used in x64. If microsoft wanted, it could have added a compiler flag that injected into after every add. Compile system critical services with it. Intel would make sure into was optimized in their next processor. This would have reclassified almost all overflow bugs from code execution to dos, overnight. We took bigger performance hits for other security code in the past. Oh well, history took an other path.
- cesarb 6y ago
  > > The bug has existed since 2003 > But microsoft was at that point still at the forefront of software dev. The moment Microsoft decided to get serious about software security (after being a laughingstock for years) was with the release of Windows XP SP2, which according to Wikipedia, was released in the middle of 2004. If the bug is from 2003, it's probably older than Microsoft's push for security. > Also, integer overflows are something the processor could protect against. See e.g. the 'into' x86 insn. I'm not sure that instruction would have helped here. From what I understand, this was not a traditional integer overflow (which could have set the overflow flag), but instead an integer truncation (using only the lower 16 bits of the register).
- metafunctor 6y ago
  Microsoft, in 2003, was the laughing stock of software security devs of the world. Perhaps they were “at the forefront” with their corporate LoC—IBM—signing off—daily status meetings -policies. But not security. The Internet happened in mid-90s, not 2005!

hyperman1 6y ago

In the general world i'd agree with you. But microsoft was at that point still at the forefront of software dev. They had build servers etc... They knew about best practices from IBM, including code reviews. What changed was the internet. Before that, say until 1998, they could deliver shoddy code without much impact, and the underpowered machines required cutting a few corners. But it saddled them with a legacy of horrible code. But they know better now. I'd expect them to audit code as critical as this somewhere between 2003 and now. Also, integer overflows are something the processor could protect against. See e.g. the 'into' x86 insn. It got dropped because disinterest used in x64. If microsoft wanted, it could have added a compiler flag that injected into after every add. Compile system critical services with it. Intel would make sure into was optimized in their next processor. This would have reclassified almost all overflow bugs from code execution to dos, overnight. We took bigger performance hits for other security code in the past. Oh well, history took an other path.

cesarb 6y ago
> > The bug has existed since 2003 > But microsoft was at that point still at the forefront of software dev. The moment Microsoft decided to get serious about software security (after being a laughingstock for years) was with the release of Windows XP SP2, which according to Wikipedia, was released in the middle of 2004. If the bug is from 2003, it's probably older than Microsoft's push for security. > Also, integer overflows are something the processor could protect against. See e.g. the 'into' x86 insn. I'm not sure that instruction would have helped here. From what I understand, this was not a traditional integer overflow (which could have set the overflow flag), but instead an integer truncation (using only the lower 16 bits of the register).
metafunctor 6y ago
Microsoft, in 2003, was the laughing stock of software security devs of the world. Perhaps they were “at the forefront” with their corporate LoC—IBM—signing off—daily status meetings -policies. But not security. The Internet happened in mid-90s, not 2005!