3 ms·
Yep, after memory safety there's still work to be done. But it'll be a lot less work.
by staticassertion 5y ago
Yep, after memory safety there's still work to be done. But it'll be a lot less work.
- Closi 5y agoConverting the entire stack to memory-safe languages to save work is definitely in the “easier said than done” bracket.
- int0x2e 5y agoActually, the fact that memory safety bugs are more difficult to exploit seems to have increased the rate of vulnerabilities discovered and exploited, and the fact that these are now often higher-level bugs (think insecure feature design bugs rather than low level implementation bugs) - means that once something is discovered, it can often be exploited in a way that is either much more pervasive or far harder to detect. So no - safer languages won't stop security from being an issue. Secure design, implementation, configuration, and frequent red-teaming exercises are the only way to reduce your risk, and even then - expect to reduce the rate by some %, but never reach zero.
- hnthrowaway0315 5y agoJust curious, what about the exploits targeting say Java VM?