3 ms·
> Approximately 100% of CVEs, crashes, bugs, [...], deserialising binary data I'd make that 98%. Outside of rounding errors in the margins, the remaining two p
by bostik 2y ago
> Approximately 100% of CVEs, crashes, bugs, [...], deserialising binary data
I'd make that 98%. Outside of rounding errors in the margins, the remaining two percent is made up of logic bugs, configuration errors, bad defaults, and outright insecure design choices.
Disclosure: infosec for more than three decades.
- epanchin 2y agoThey forgot to account for those edge cases
- delta_p_delta_x 2y agoHeh, touché.
- delta_p_delta_x 2y agoI feel vindicated but also a bit surprised that my gut feeling was this accurate.
- bostik 2y agoNot really a surprise, to be honest. "Deserialisation" encapsulates most forms of injection attacks. OWASP top-10 was dominated by those for a very long time. They have only recently been overtaken by authorization failures.