4 ms·

“70% of security vulnerabilities caused by memory safety problems” This is only true in certain contexts isn’t it? I seem to recall reading recently that some

“70% of security vulnerabilities caused by memory safety problems” This is only true in certain contexts isn’t it? I seem to recall reading recently that some very high percentage of web security holes are caused by insecure exposed functions.

nyrikki 3y ago
Here is the context which is probably process type vulnerabilities in most people minds: "Around 70 percent of all the vulnerabilities in Microsoft products addressed through a security update each year are memory safety issues" https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se...
- topspin 3y ago
  Google also makes claims[1] corroborating this ratio in their own work. It's an endless ammo supply for the memory safety argument. (The linked story doesn't argue otherwise, despite the headline.) [1] https://www.chromium.org/Home/chromium-security/memory-safety/ https://www.chromium.org/Home/chromium-security/memory-safet...
wredue 3y ago
That is correct. Measurements including all vulnerabilities have memory safety ones somewhere in the ballpark of 15%. A pretty extreme minority overall. This doesn’t gel with the hive mind though, so you probably won’t see it pop up terribly often.
- andrewstuart 3y ago
  So in fact this whole shebang about memory safety is driven by a statistic about memory safety errors in Microsoft products. And yet the memory safety advocates everywhere are waving that number around like 70% of all security issues are caused by memory safety. I note Chromium project also says "The Chromium project finds that around 70% of our serious security bugs are memory safety problems." https://www.chromium.org/Home/chromium-security/memory-safety/ https://www.chromium.org/Home/chromium-security/memory-safet... Then you get headlines like this: "Microsoft: 70 percent of all security bugs are memory safety issues", which is flat out wrong and contradicts itself the first line of the article. https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se... The HN post that we are commenting on even says "To me, the fact 70% of security vulnerabilities arise from a lack of memory safety is not the reason that memory safety is important." which is also false and certainly needs clarification.
  - vacuity 3y ago
    Perhaps the correct statement is something like "70% of security vulnerabilities in large projects written in C or C++ are memory safety issues", with the understanding that there are both a lot of software that are and aren't subject to that statistic.

nyrikki 3y ago

Here is the context which is probably process type vulnerabilities in most people minds: "Around 70 percent of all the vulnerabilities in Microsoft products addressed through a security update each year are memory safety issues" https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se...

topspin 3y ago
Google also makes claims[1] corroborating this ratio in their own work. It's an endless ammo supply for the memory safety argument. (The linked story doesn't argue otherwise, despite the headline.) [1] https://www.chromium.org/Home/chromium-security/memory-safety/ https://www.chromium.org/Home/chromium-security/memory-safet...

wredue 3y ago

That is correct. Measurements including all vulnerabilities have memory safety ones somewhere in the ballpark of 15%. A pretty extreme minority overall. This doesn’t gel with the hive mind though, so you probably won’t see it pop up terribly often.

andrewstuart 3y ago
So in fact this whole shebang about memory safety is driven by a statistic about memory safety errors in Microsoft products. And yet the memory safety advocates everywhere are waving that number around like 70% of all security issues are caused by memory safety. I note Chromium project also says "The Chromium project finds that around 70% of our serious security bugs are memory safety problems." https://www.chromium.org/Home/chromium-security/memory-safety/ https://www.chromium.org/Home/chromium-security/memory-safet... Then you get headlines like this: "Microsoft: 70 percent of all security bugs are memory safety issues", which is flat out wrong and contradicts itself the first line of the article. https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se... The HN post that we are commenting on even says "To me, the fact 70% of security vulnerabilities arise from a lack of memory safety is not the reason that memory safety is important." which is also false and certainly needs clarification.
- vacuity 3y ago
  Perhaps the correct statement is something like "70% of security vulnerabilities in large projects written in C or C++ are memory safety issues", with the understanding that there are both a lot of software that are and aren't subject to that statistic.