3 ms·

The whole memory safety thing is based on a falsehood. Memory safety is where it is because of misquotes and misinterpretations. Here are the incorrect quotes

The whole memory safety thing is based on a falsehood. Memory safety is where it is because of misquotes and misinterpretations. Here are the incorrect quotes: "70% of all security vulnerabilities were caused by memory safety issues" https://en.wikipedia.org/wiki/Memory_safety https://en.wikipedia.org/wiki/Memory_safety In 2019, a Microsoft security engineer reported that 70% of all security vulnerabilities were caused by memory safety issues. In 2020, a team at Google similarly reported that 70% of all "severe security bugs" in Chromium were caused by memory safety problems. "Microsoft: 70 percent of all security bugs are memory safety issues " https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se... The actual quote from Matt Miller is this (quoted from the SAME article that has a false headline above) https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se... "Microsoft security engineer Matt Miller said that over the last 12 years, around 70 percent of all Microsoft patches were fixes for memory safety bugs." So it is FALSE that "70% of all security vulnerabilities were caused by memory safety issues". What Matt Miller said is that "70% of all Microsoft patches were fixes for memory safety bugs" - that is VERY different. As a result, the fiction that "70% of all security vulnerabilities were caused by memory safety issues" has become real to many people thus they are focusing their security effort on memory safety when that is not even the primary security issue and certainly not 70% of all security issues.

znkr 3y ago
You’ll find more primary sources across different organizations that all arrive at the 60 - 70% number. But what really grinds my gears here is that you take a piece from the article you’re criticizing and pretend that it’s a quote from Matt Miller. It’s actually quite easy to find a primary source here because the slides from the talk that the article is based on are available: https://github.com/microsoft/MSRC-Security-Research/blob/master/presentations/2019_02_BlueHatIL/2019_01%20-%20BlueHatIL%20-%20Trends%2C%20challenge%2C%20and%20shifts%20in%20software%20vulnerability%20mitigation.pdf https://github.com/microsoft/MSRC-Security-Research/blob/mas... To quote from those slides: „~70% of the vulnerabilities addressed through a security update each year continue to be memory safety issues“.
- andrewstuart 3y ago
  You didn’t read the linked article. It directly attributes Matt Miller. And the point is that this percentage quoted is the flaws in Microsoft products, not all security vulnerabilities as is falsely claimed.
  - znkr 3y ago
    It’s an indirect quotation, not a quote from a primary source. Your quotation is a quotation of the article, not of Matt Miller. Read the primary sources, the misunderstanding is yours.

znkr 3y ago

You’ll find more primary sources across different organizations that all arrive at the 60 - 70% number. But what really grinds my gears here is that you take a piece from the article you’re criticizing and pretend that it’s a quote from Matt Miller. It’s actually quite easy to find a primary source here because the slides from the talk that the article is based on are available: https://github.com/microsoft/MSRC-Security-Research/blob/master/presentations/2019_02_BlueHatIL/2019_01%20-%20BlueHatIL%20-%20Trends%2C%20challenge%2C%20and%20shifts%20in%20software%20vulnerability%20mitigation.pdf https://github.com/microsoft/MSRC-Security-Research/blob/mas... To quote from those slides: „~70% of the vulnerabilities addressed through a security update each year continue to be memory safety issues“.

andrewstuart 3y ago
You didn’t read the linked article. It directly attributes Matt Miller. And the point is that this percentage quoted is the flaws in Microsoft products, not all security vulnerabilities as is falsely claimed.
- znkr 3y ago
  It’s an indirect quotation, not a quote from a primary source. Your quotation is a quotation of the article, not of Matt Miller. Read the primary sources, the misunderstanding is yours.