5 ms·

the easier question to ask is what HASN'T Microsoft done? quick example: they paid millions possibly tens of millions for the best people from industry and aca

by munin 15y ago

the easier question to ask is what HASN'T Microsoft done? quick example: they paid millions possibly tens of millions for the best people from industry and academia to build automatic bug searching tools. these tools currently define state of the art for finding bugs in applications. they also have a community outreach program where they will work with companies and individuals that report flaws. that same outreach program will work internally with the relevant product groups to get flaws fixed. oh and also they invest constantly in improvements to their toolchain and operating system runtime to make exploitable bugs harder (safeSEH, ASLR, DEP, GS cookies, EMET, encoded pointers, safe-unlinked heaps both in user and kernel mode, etc). and yet, you realize, there are still exploitable bugs. in my opinion you should regard this as the fundamental instability of system software written in C. if microsoft can't get that right (in terms of security and stability), after all that they've invested, who can?

rbarooah 15y ago
1. Where are those bug searching tools used? 2. I'd agree that the outreach program is something that Apple clearly hasn't done. 3. Apple clearly is doing this too. HP's work on secret agents in the 90's shows that you can't prove code to be trustworthy. You can only assign trust to the intentions of the originator. Therefore, the most significant thing you can do to improve security is to verify the provenance of trusted code and the isolation of untrusted code. Windows clearly has decent technical code-signing infrastructure, but Apple seems far ahead in terms of effectively deploying this model into the field.
- angersock 15y ago
  "1. Where are those bug searching tools used?" Microsoft has some good static code analysis tools ( http://msdn.microsoft.com/en-us/gg712340 http://msdn.microsoft.com/en-us/gg712340 ), for a start. "3. Apple clearly is doing this too." They seem more concerned about not letting users jailbreak their devices than anything else. "Windows clearly has decent technical code-signing infrastructure, but Apple seems far ahead in terms of effectively deploying this model into the field." "Far ahead"? How do you justify that claim? Most charitably, it seems that both companies work on security. Of the two, Microsoft seems to have better documentation, better openness, and better tools.
  - rbarooah 15y ago
    By #3 I was referring to the parent's 3rd comment about the focus on improving the toolchain and runtime. I doubt that you're serious about the jailbreak comment. By far ahead, I was referring to the deployment of code signing technology. I think it's pretty clear that although Microsoft has solid code signing technology, they are much further behind in promoting effective use of it in the field.
  - Zev 15y ago
    That jailbreaking works by taking advantage of OS exploits to gain root access, and, in fact, represents a glaringly obvious, popular, and easy to use vulnerabilit has nothing to do with Apple fixing it quickly?
  - nirvana 15y ago
    > They seem more concerned about not letting users jailbreak their devices than anything else. Ironic that you would use a feature that excludes malware from running but pisses off android fans, as an attempt to claim that Apple is not working on security!
  - tedunangst 15y ago
    "Microsoft has some good static code analysis tools ( http://msdn.microsoft.com/en-us/gg712340 http://msdn.microsoft.com/en-us/gg712340 ), for a start." The compound word 'PreOrder' exists as a discrete term. ... case it as 'Preorder' or strip the first token entirely if it represents any sort of Hungarian notation. Aw shit, Apple is gonna get fucked by all those remotely exploitable Hungarian notation bugs.
tedunangst 15y ago
these tools currently define state of the art for finding bugs in applications. The stuff in Visual Studio is so far behind the state of the art I don't even know where to begin. But let's ignore that and recalibrate by asking this. What do you think the not quite state of the art second best automatic bug finding tool is?

by munin 15y ago

rbarooah 15y ago

1. Where are those bug searching tools used? 2. I'd agree that the outreach program is something that Apple clearly hasn't done. 3. Apple clearly is doing this too. HP's work on secret agents in the 90's shows that you can't prove code to be trustworthy. You can only assign trust to the intentions of the originator. Therefore, the most significant thing you can do to improve security is to verify the provenance of trusted code and the isolation of untrusted code. Windows clearly has decent technical code-signing infrastructure, but Apple seems far ahead in terms of effectively deploying this model into the field.

angersock 15y ago
"1. Where are those bug searching tools used?" Microsoft has some good static code analysis tools ( http://msdn.microsoft.com/en-us/gg712340 http://msdn.microsoft.com/en-us/gg712340 ), for a start. "3. Apple clearly is doing this too." They seem more concerned about not letting users jailbreak their devices than anything else. "Windows clearly has decent technical code-signing infrastructure, but Apple seems far ahead in terms of effectively deploying this model into the field." "Far ahead"? How do you justify that claim? Most charitably, it seems that both companies work on security. Of the two, Microsoft seems to have better documentation, better openness, and better tools.
- rbarooah 15y ago
  By #3 I was referring to the parent's 3rd comment about the focus on improving the toolchain and runtime. I doubt that you're serious about the jailbreak comment. By far ahead, I was referring to the deployment of code signing technology. I think it's pretty clear that although Microsoft has solid code signing technology, they are much further behind in promoting effective use of it in the field.
- Zev 15y ago
  That jailbreaking works by taking advantage of OS exploits to gain root access, and, in fact, represents a glaringly obvious, popular, and easy to use vulnerabilit has nothing to do with Apple fixing it quickly?
- nirvana 15y ago
  > They seem more concerned about not letting users jailbreak their devices than anything else. Ironic that you would use a feature that excludes malware from running but pisses off android fans, as an attempt to claim that Apple is not working on security!
- tedunangst 15y ago
  "Microsoft has some good static code analysis tools ( http://msdn.microsoft.com/en-us/gg712340 http://msdn.microsoft.com/en-us/gg712340 ), for a start." The compound word 'PreOrder' exists as a discrete term. ... case it as 'Preorder' or strip the first token entirely if it represents any sort of Hungarian notation. Aw shit, Apple is gonna get fucked by all those remotely exploitable Hungarian notation bugs.

tedunangst 15y ago

these tools currently define state of the art for finding bugs in applications. The stuff in Visual Studio is so far behind the state of the art I don't even know where to begin. But let's ignore that and recalibrate by asking this. What do you think the not quite state of the art second best automatic bug finding tool is?