3 ms·
Big makes it challenging. But also we are talking about big companies. The OSX/Apple, Windows/Microsoft and linux/IBM/Goog/Amazon/long-tail are big enough that
by jacobr1 5y ago
Big makes it challenging. But also we are talking about big companies. The OSX/Apple, Windows/Microsoft and linux/IBM/Goog/Amazon/long-tail are big enough that they already invest lots in security and can invest even more. This is where central tooling teams and come into play.
- giantrobot 5y agoI was at Apple for more than 15 years in SWE. The scale of OS builds isn't just big but just this side of intractable. They have tool and build teams. It's not an easily solved problem and you can't just throw money at it to make it so. The OS has thousands of components with combinatorial amounts of different interactions and states. You can have multiple bug free components that create an exploitable situation in combination. The same is true for Windows or Linux or any large software project. Unit tests are not magic. Neither is fuzzing. Even if you've got a great fuzzing infrastructure and coverage it still takes non-zero time for an engineer to analyze, understand, and then fix a problem. Many components in an OS require a fair amount of domain knowledge so engineers aren't fungible. You can't grab Sally from the Mail team and give her a bunch of CoreMedia bugs to fix. Keep in mind all the companies you mention invest significantly in security and just barely keep ahead of exploits and often can't keep ahead of exploits. Hackers don't have the same burden. They don't need to find every bug. They only need to find a profitable one (depending on the hat they're wearing). They also don't need to maintain their exploit in future versions. They just move on to find the next exploit.