4 ms·

Sure, but we've been trying to "just fix the bugs in the C codebase" for ~30 years now and it just keeps getting worse.

• tonyedgecombe 5y ago
  >and it just keeps getting worse. Is there any evidence for that because my perception is it has become much harder to exploit systems.
  • xvector 5y ago
    What we are seeing is a problem with the very fundamentals of software written in non-memory-safe languages. Everything we do is a bandaid. Any sufficiently funded group will find the zero days they need to exploit the users they want. It's not even a question of if they will find it, or when they will find it. They will find it and they will use it for unethical means. This whole situation is hopeless until we go back to the basics and build systems from the ground-up with security in mind rather than trying to slap band-aids on architectures that were developed when computer security didn't even exist as a serious concept.
    • tonyedgecombe 5y ago
      None the less is there any evidence that "it just keeps getting worse"?
      • deleted 5y ago
        [deleted]
      • xvector 5y ago
        https://www.rapid7.com/blog/post/2018/04/30/cve-100k-by-the-numbers/ https://www.rapid7.com/blog/post/2018/04/30/cve-100k-by-the-...
        • pvarangot 5y ago
          That may just mean more software is being written and older software can still have a vulnerability that gets a CVE assigned. Also a lot of CVEs are for potentially dangerous crashes that not necessarily can be a exploited and of course a lot of them are for client sides requiring a lot of user intervention. So no what Rapid7 is saying doesn't mean it's getting worse. Also they sell offensive penetration testing software, they have an interest in making your believe it's getting worse.