6 ms·
It would be amazing if there were a Manhattan Project for eliminating memory-unsafe code from modern operating systems and browser engines. This would probably
by SheinhardtWigCo 3y ago
It would be amazing if there were a Manhattan Project for eliminating memory-unsafe code from modern operating systems and browser engines. This would probably increase the cost of pwning VIPs and critical infrastructure by several orders of magnitude.
- _8j50 3y agoI don't think so. Outside of labs, I can't remember needing memory safety exploitation or hearing about a major compromise that used such an exploit. I am not saying the security improvements are not real, just not orders of magnitude. For example some post exploitation stuff like BYOVD I am sure would be much harder. A lot of vulns are just mistakes people made. Perhaps LLMs can help with that in the neat future but right now you hardly even need a CVE to compromise even well protected networks. A little phish here, a little abuse of legit software there, patiently look for services and credentials that aren't well protected and voila. Few actors use 0days and auto-updates have made 1-days hard to rely on
- selfmodruntime 3y ago> I don't think so. Outside of labs, I can't remember needing memory safety exploitation or hearing about a major compromise that used such an exploit. NSO group. Stuxnet.
- _8j50 3y agoI said "I" as in myself who is neither of those things. I also said the following because of in part the point you are trying to make: > I am not saying the security improvements are not real
- astrea 3y ago[flagged]
- stouset 3y agoWhat exactly leads you to believe these “better” developers aren’t already working for employers who benefit from these skills? If they are already working elsewhere, what do you think happens when they go to Microsoft and leave their current employer?
- naikrovek 3y agotime has shown repeatedly that eventually any given programmer will make mistakes with memory management, no matter how diligent they are. it cannot be avoided; no developer has a flawless day every single day. it's not a failing of the developer when it is known and well understood that humans make errors continually, and that this cannot be prevented. computers exist entirely to help us with things we aren't good at, like memory management.
- rowanG077 3y agoWhere exactly are these better developers? Even DJB is known to produce faulty C code. And I struggle to come up with someone who surpasses him in C.
- nick__m 3y agoI am not qualified to says if he surpasses him but I am pretty sure that Fabrice Bellard is at least his equal.
- nmfisher 3y agoGood example - and if we look at the ffmpeg security page[0], we can see dozens of CVEs going back to 2008, many related to manual memory management. I know it wasn't you saying this, but "just be a better programmer" is a dumb response to improvements on the language side. [0] https://ffmpeg.org/security.html https://ffmpeg.org/security.html
- UK-Al05 3y agoGood Devs apply constraints to themselves.
- astockwell 3y agoSadly, humans would remain the weakest link (in terms of PWNing defenses).
- cyberbanjo 3y agoRemain? Humans /may become/ the weakest link after remote code execution exploits cease to be discovered, but certain hacks require no human in the loop.
- FreakLegion 3y agoIt wouldn't noticeably change the unit economics. Very few attacks rely on memory exploits. Edit: This appears to be confusing to people, so here are some examples you'll recall from the past few years: SolarWinds, the Colonial Pipeline hack, the Okta breach, the Uber breach. Most attacks don't rely on memory exploits.
- matheusmoreira 3y agoAren't memory bugs in I/O layers the most common source of vulnerabilities?
- worthless-trash 3y agoCareful about pointing out dirtycow, because you'll be downvoted.
- overthrow 3y agoThe majority of CVEs are due to memory exploits. For C/C++ code that holds true across companies and OSs Microsoft says 70% https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se... Google says 70% https://www.chromium.org/Home/chromium-security/memory-safety/ https://www.chromium.org/Home/chromium-security/memory-safet...
- NikolaNovak 3y agoI don't know if this is pedantic, but op indicated "attacks" not "vulnerabilities". I would not be surprised if statistics in vulnerabilities are different than statistics in realized attacks?
- overthrow 3y agoIf there's a difference I'm open to someone citing a source quantifying it, but I won't quite be convinced by unsourced blanket generalizations that go against common wisdom
- DANmode 3y agoYou say that like you know for certain that this isn't part of such a thing!
- otterley 3y agoIf you know that there is such an initiative already in progress, speak up!
- DANmode 3y agoP.S. Subtle reference, love the product placement.
- signal11 3y agoIronically Mozilla began to sponsor Rust as part of their Servo project. Before they laid everyone off and made Servo a volunteer-run project. I do feel they should have persevered. Although, yeah, writing a new rendering engine from scratch is a big job.
- Lorkki 3y agoAs far as I know, Servo wasn't ever really intended to be a production browser. But significant parts of Firefox have been rewritten in Rust since, and those parts have included bits from Servo.
- signal11 3y agoOh, thank you, I wasn’t aware. They even have a decent graph linked to off[1]: https://4e6.github.io/firefox-lang-stats/ https://4e6.github.io/firefox-lang-stats/ [1] https://wiki.mozilla.org/Oxidation https://wiki.mozilla.org/Oxidation
- aembleton 3y agoHow is that ironic?