3 ms·

It's not the quality, it's the quantity. We are living in a new age where everything is software driven, so naturally there will be more 0-days.

robocat 4y ago
https://www.cvedetails.com/product/32238/Microsoft-Windows-10.html?vendor_id=26 https://www.cvedetails.com/product/32238/Microsoft-Windows-1... There has been an increase from ~50 code execution bugs per year (2016—18) to more than 100 per year (2019—2022) in Windows 10, which makes us think that software has got worse. Presumably the vast majority of the vulnerabilities in Windows 10 have been in Windows 10 from its release date. So it is reasonable to assume that we detect more bugs, not that the actual number increased. I still notice a raft of bugs in iPadOS, including egregious UI errors in new features like multitasking, but the quality of iPadOS is generally improving (anecdotally).
- DanMcInerney 4y ago
  It's far more likely that software is improving, but the tools to break it and the number of people willing to invest the time in learning those tools, is increasing. The fact is there are absolutely untold amounts of bugs in every piece of software every written. Finding those bugs, up until the past decade of automation tools to find/exploit them, has been extremely time consuming with few people patient or curious enough to improve their skills in that arena. Think about the number of programming frameworks that've come out in the past few years. Or GitHub Copilot and ChatGPT which literally write solid code for you. There's no way software has not improved a lot in the past decade but there are WAY more software devs than there are exploit devs or hackers. Similar to the ratio of lions:wildebeest. Way more prey than predators.
  - robocat 4y ago
    Except Microsoft should have world-class internal teams creating fuzzer tools and applying open source tools: you would hope that Microsoft had kept ahead of the hoipolloi.

robocat 4y ago

https://www.cvedetails.com/product/32238/Microsoft-Windows-10.html?vendor_id=26 https://www.cvedetails.com/product/32238/Microsoft-Windows-1... There has been an increase from ~50 code execution bugs per year (2016—18) to more than 100 per year (2019—2022) in Windows 10, which makes us think that software has got worse. Presumably the vast majority of the vulnerabilities in Windows 10 have been in Windows 10 from its release date. So it is reasonable to assume that we detect more bugs, not that the actual number increased. I still notice a raft of bugs in iPadOS, including egregious UI errors in new features like multitasking, but the quality of iPadOS is generally improving (anecdotally).

DanMcInerney 4y ago
It's far more likely that software is improving, but the tools to break it and the number of people willing to invest the time in learning those tools, is increasing. The fact is there are absolutely untold amounts of bugs in every piece of software every written. Finding those bugs, up until the past decade of automation tools to find/exploit them, has been extremely time consuming with few people patient or curious enough to improve their skills in that arena. Think about the number of programming frameworks that've come out in the past few years. Or GitHub Copilot and ChatGPT which literally write solid code for you. There's no way software has not improved a lot in the past decade but there are WAY more software devs than there are exploit devs or hackers. Similar to the ratio of lions:wildebeest. Way more prey than predators.
- robocat 4y ago
  Except Microsoft should have world-class internal teams creating fuzzer tools and applying open source tools: you would hope that Microsoft had kept ahead of the hoipolloi.