3 ms·

FALSE - this is so misleading - these statements imply that 68% to 70% of ALL SECURITY ISSUES are due to memory safety - that's wrong and those quotes leave out

FALSE - this is so misleading - these statements imply that 68% to 70% of ALL SECURITY ISSUES are due to memory safety - that's wrong and those quotes leave out the important context. From the post: Microsoft's bug telemetry reveals that 70% of its vulnerabilities would be stopped by memory-safe programming languages. Google's research has found 68% of 0day exploits are related to memory corruption. These sorts of false statements make people everywhere think that memory safety is a bigger issue than it is and that it impacts almost all application development which is completely wrong.

binarycrusader 2y ago
Disclaimer: Speaking only for myself. memory safety is a bigger issue than it is and that it impacts almost all application development which is completely wrong. It specifically states that in the context of vulnerabilities so I'm not sure why it's believed to be insufficiently qualifying. With that said, while you're right to question the precisions of statements, Google says the same for their own data: https://www.chromium.org/Home/chromium-security/memory-safety/ https://www.chromium.org/Home/chromium-security/memory-safet... Around 70% of our high severity security bugs are memory unsafety problems (that is, mistakes with C/C++ pointers). Half of those are use-after-free bugs. ...so it's not just Microsoft saying that. You'll also see this mentioned on Wikipedia: https://en.wikipedia.org/wiki/Memory_safety https://en.wikipedia.org/wiki/Memory_safety Going farther, the numbers vary, sometimes even more: https://www.memorysafety.org/docs/memory-safety/#how-common-are-memory-safety-vulnerabilities https://www.memorysafety.org/docs/memory-safety/#how-common-... Extremely. A recent study found that 60-70% of vulnerabilities in iOS and macOS are memory safety vulnerabilities. Microsoft estimates that 70% of all vulnerabilities in their products over the last decade have been memory safety issues. Google estimated that 90% of Android vulnerabilities are memory safety issues. An analysis of 0-days that were discovered being exploited in the wild found that more than 80% of the exploited vulnerabilities were memory safety issues. In short, I don't think the context here will change most folks' interpretation of the results--nor do I think it should. Any network-connected device is inherently multi-user and the security of that device is only as effective as the least secure program executing on that device at a particular permission level. I can think of very few applications today that don't interact with a network in some way. In addition to that, my opinion is that most memory-safety issues that create vulnerabilities are also reliability issues. Secure applications are generally inherently more reliable applications.
- andrewstuart 2y ago
  The full context is that MS and Google said these things - SPECIFICALLY about their compiled consumer applications. NOT as a general statement about all security vulnerabilities. So its false and wrong.

binarycrusader 2y ago

Disclaimer: Speaking only for myself. memory safety is a bigger issue than it is and that it impacts almost all application development which is completely wrong. It specifically states that in the context of vulnerabilities so I'm not sure why it's believed to be insufficiently qualifying. With that said, while you're right to question the precisions of statements, Google says the same for their own data: https://www.chromium.org/Home/chromium-security/memory-safety/ https://www.chromium.org/Home/chromium-security/memory-safet... Around 70% of our high severity security bugs are memory unsafety problems (that is, mistakes with C/C++ pointers). Half of those are use-after-free bugs. ...so it's not just Microsoft saying that. You'll also see this mentioned on Wikipedia: https://en.wikipedia.org/wiki/Memory_safety https://en.wikipedia.org/wiki/Memory_safety Going farther, the numbers vary, sometimes even more: https://www.memorysafety.org/docs/memory-safety/#how-common-are-memory-safety-vulnerabilities https://www.memorysafety.org/docs/memory-safety/#how-common-... Extremely. A recent study found that 60-70% of vulnerabilities in iOS and macOS are memory safety vulnerabilities. Microsoft estimates that 70% of all vulnerabilities in their products over the last decade have been memory safety issues. Google estimated that 90% of Android vulnerabilities are memory safety issues. An analysis of 0-days that were discovered being exploited in the wild found that more than 80% of the exploited vulnerabilities were memory safety issues. In short, I don't think the context here will change most folks' interpretation of the results--nor do I think it should. Any network-connected device is inherently multi-user and the security of that device is only as effective as the least secure program executing on that device at a particular permission level. I can think of very few applications today that don't interact with a network in some way. In addition to that, my opinion is that most memory-safety issues that create vulnerabilities are also reliability issues. Secure applications are generally inherently more reliable applications.

andrewstuart 2y ago
The full context is that MS and Google said these things - SPECIFICALLY about their compiled consumer applications. NOT as a general statement about all security vulnerabilities. So its false and wrong.