3 ms·
One type error, one timing attack and six memory safety problems. Defect ratio checks out.
by topspin 4y ago
One type error, one timing attack and six memory safety problems. Defect ratio checks out.
- lucb1e 4y agoRatio of what to what? Do you mean the number of bugs one would expect to find in a modern implementation (the former two) as a ratio to the number of bugs one finds in old C code (all of the above)?
- topspin 4y agoBasically. Microsoft and Google have both analyzed software defects and claimed that memory safety violations account for ~70%. I don't have time to dig up citations atm, but it's not hard to find. I think the Google results are 'security' related defects whereas the Microsoft results are all defects, but look it up yourself.
- lucb1e 4y agoNo need, I had the same initial reaction as I scrolled through the list, going from "oh that's a lot of security issues... and virtually all C issues, too... ugh why do we still do this"
- mynameisash 4y agoFrom Microsoft[0]: "As we’ve seen, roughly 70% of the security issues that the MSRC assigns a CVE to are memory safety issues." And from Google[1]: "memory safety bugs continue to be a top contributor of stability issues, and consistently represent ~70% of Android’s high severity security vulnerabilities." [0] https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe-systems-programming/ https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe... [1] https://security.googleblog.com/2021/04/rust-in-android-platform.html https://security.googleblog.com/2021/04/rust-in-android-plat...
- deleted 4y ago[deleted]
- akira2501 4y agoOpenSSL is not a security product. It's a loss leader for a security company that sells support contracts. There isn't very much incentive for them to turn out a good product.