4 ms·

for another operating system, we have ~70% of security bugs being memory safety issues (https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-

for another operating system, we have ~70% of security bugs being memory safety issues (https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se...). sounds like a decent majority to me.

ncmncm 5y ago
Windows is Windows, and Microsoft is Microsoft. Extrapolation from those to anywhere else in the universe does not generate a plausible argument.
- deleted 5y ago
  [deleted]
- kobebrookskC3 5y ago
  how about https://www.chromium.org/Home/chromium-security/memory-safety https://www.chromium.org/Home/chromium-security/memory-safet... https://langui.sh/2019/07/23/apple-memory-safety/ https://langui.sh/2019/07/23/apple-memory-safety/ these companies apply things like sandboxing and fuzzing to reduce the incidence of memory unsafety bugs, and yet they're finding a majority of their security bugs being memory unsafety. if you can't find memory unsafety in your c++ code, it's because your code isn't worth attacking.
  - ncmncm 5y ago
    These, also, are not Linux. If in fact Linux CVEs matched such a pattern, somebody would be certain to be jumping up and down pointing it out.
    - kobebrookskC3 5y ago
      hey, whaddya know, i just stumbled upon this today https://twitter.com/geofft/status/1132739184060489729 https://twitter.com/geofft/status/1132739184060489729
fulafel 5y ago
There's a similar effect as Amdahl's law with these. Only after programmers come to their senses and opt to take care of that 70%, we get to the remaining part of the pie and its subdivisions, and can start thinking about the actually interesting part of engineering secure systems. The overwhelming prevalence and impact of memory safety bugs has retared development of solutions for the remaining, nontrivial problems for many decades, by consuming so much of the attention.

ncmncm 5y ago

Windows is Windows, and Microsoft is Microsoft. Extrapolation from those to anywhere else in the universe does not generate a plausible argument.

deleted 5y ago
[deleted]
kobebrookskC3 5y ago
how about https://www.chromium.org/Home/chromium-security/memory-safety https://www.chromium.org/Home/chromium-security/memory-safet... https://langui.sh/2019/07/23/apple-memory-safety/ https://langui.sh/2019/07/23/apple-memory-safety/ these companies apply things like sandboxing and fuzzing to reduce the incidence of memory unsafety bugs, and yet they're finding a majority of their security bugs being memory unsafety. if you can't find memory unsafety in your c++ code, it's because your code isn't worth attacking.
- ncmncm 5y ago
  These, also, are not Linux. If in fact Linux CVEs matched such a pattern, somebody would be certain to be jumping up and down pointing it out.
  - kobebrookskC3 5y ago
    hey, whaddya know, i just stumbled upon this today https://twitter.com/geofft/status/1132739184060489729 https://twitter.com/geofft/status/1132739184060489729

fulafel 5y ago

There's a similar effect as Amdahl's law with these. Only after programmers come to their senses and opt to take care of that 70%, we get to the remaining part of the pie and its subdivisions, and can start thinking about the actually interesting part of engineering secure systems. The overwhelming prevalence and impact of memory safety bugs has retared development of solutions for the remaining, nontrivial problems for many decades, by consuming so much of the attention.