21–30 of 59 posts
"We’re determined to make Microsoft Edge the safest and most secure browser." Then open source the whole thing, not just little parts of it. It has the lowest number of vulnerabilities in the National Vulnerability Database because it has the least number of eyes able to look for them.
Yes, because it has helped OpenSSL a lot.
Earlier quoted context omitted.
The point isn't that every open source app is awesome, it is that now you KNOW. You're directing snark towards OpenSSL presumably because you think it's a poorly coded. If it was closed source you might not even be aware of the issues and there certainly wouldn't be the open source efforts to code alternatives.
If it was closed-source, we would assume it had lots of issues until reviewed by a qualified, third party that we trust saying otherwise who also gives us signed hash for binary that was reviewed. The way it's been done in proprietary evaluations a long time. It would be done more if companies were actually interested in a real evaluation instead of a stamp that knocks out their liability. ;) Under DOD's TCSEC criter…
Am I reading correctly: WDAGfME (for lack of a better acronum) is essentially starting a VM with a fresh copy of Windows for every site that it is protecting ? Does this happen for every open & protected tab/window? What kind of overhead does it have? The idea sounds similar to Qubes OS, with the exception that it's transparent to the user and doesn't have to be configured by the end-user. I presume this kills any of…
https://www.acsa-admin.org/2006/papers/epstein-paper.pdf
Vendors of separation kernels, with Green Hills in lead, started distributing MILS workstations with browser VM's and such in 2005:
http://www.ghs.com/news/20050419_secure_products.html
Tahoma started first browser-oriented OS running on Xen and Linux in 2006:
https://www.gribble.org/papers/gribble-Tahoma.pdf
Finally, OP Web Browser applied POLA and safe languages internally around 2008 with Chrome partly copying it (with less security for performance):
http://www.cse.psu.edu/~trj1/cse543-s15/docs/grier_sp08.pdf
So, high-assurance community has been on this with numerous projects and products released. Many had small, strong TCB's. The oldest had the color schemes and everything. QubesOS is the newcomer with less security than many forerunners but great usability & openness. Better than average Linux distro. Closest to prior designs with active community is genode.org.
Earlier quoted context omitted.
It's been a little while since I was close to Microsoft (they were a client for a bit at Matasano), but: those people spend more on software security for WINMINE.EXE than a lot of startups do for their whole stack. Would their software be safer if it was open source? Probably. Open code is rarely a loss for security. But it's not easy to say how much safer. Probably less than you think.
I recall the Windows source leaked a long time ago. One programmer wrote an article on it saying it was actually good code. The problem areas seem to be little hacks they had littered everywhere to keep 3rd party hardware or software from breaking. My bookmark leads to a missing article that's not in Wayback Machine. Do you have a substitute link to a review by a qualified person who got to look at the source? I'd be…
>One programmer wrote an article on it saying it was actually good code.
"one programmer" commenting about 30+ million lines of code. Yeah. uh-huh. Anyway, you can still find the kernel's source if you care to dig around. Its the Windows Research Kernel but it's mostly unchanged from the commercial codebase.
>The problem areas seem to be little hacks they had littered everywhere to keep 3rd party hardware or software from breaking.
Those are mostly relegated to the compatibility shim layer. You can turn it off, in any case.
Earlier quoted context omitted.
If it was closed-source, we would assume it had lots of issues until reviewed by a qualified, third party that we trust saying otherwise who also gives us signed hash for binary that was reviewed. The way it's been done in proprietary evaluations a long time. It would be done more if companies were actually interested in a real evaluation instead of a stamp that knocks out their liability. ;) Under DOD's TCSEC criter…
In the case of edge, Microsoft could do both. Not sure where the drawback would be.
That's my theory anyway. They share source with some but highly selective with plenty restrictions.
Earlier quoted context omitted.
I recall the Windows source leaked a long time ago. One programmer wrote an article on it saying it was actually good code. The problem areas seem to be little hacks they had littered everywhere to keep 3rd party hardware or software from breaking. My bookmark leads to a missing article that's not in Wayback Machine. Do you have a substitute link to a review by a qualified person who got to look at the source? I'd be…
Yes, it leaked during the Win2K release cycle I believe. And you're probably thinking about the kuro5hin website, where someone claimed to have analyzed it. ( http://webcache.googleusercontent.com/search?q=cache:3BlVJSk... ) >One programmer wrote an article on it saying it was actually good code. "one programmer" commenting about 30+ million lines of code. Yeah. uh-huh. Anyway, you can still find the kernel's source…
Yeah, my inability to evaluate the skill level or character of source was main drawback of claim. I gave a little credence to it because I knew that they were ramping up QA due to image problems and potential lost sales. Steve Lipner... who did high-assurance security with legendary Paul Karger... came in to turn it around with the SDL. Massive investment in professional programmers to find quality issues across the lifecycle implies it would have fewer issues than average software.
https://msdn.microsoft.com/en-us/library/ms995349.aspx
""one programmer" commenting about 30+ million lines of code. Yeah. uh-huh."
You can tell a lot by glancing at random samples while digging into a bit fewer. Good, well-commented code with various security checks stands out for people that spend years looking at the opposite. All such a review could say, though, was that people were putting in effort. Actual security would need thorough review.
"Anyway, you can still find the kernel's source if you care to dig around. Its the Windows Research Kernel but it's mostly unchanged from the commercial codebase."
Will do. Appreciate the tip.
Earlier quoted context omitted.
Yes, because it has helped OpenSSL a lot.
Not sure what you mean, it has benefited from security researchers looking at the code base. They haven't found everything but they found many things.
A closed development with good effort is more trustworthy than an open one with low effort or review. One exception being subversion where open-source can spot most idiotic backdoors. Less likely to catch good, obfuscated ones. From there, an open development with strong effort and review is more trustworthy than a similar, close one. Amount of effort and quality of review are only consistent indicators.
Fewest vulnerabilities: I suspect that Chrome and Firefox being open source is a factor here. Thus it seems possible to me that they actually have fewer vulnerabilities than Edge—Edge’s just haven’t been found yet. This is pure speculation on my part; I have no evidence nor any investigation, deep or otherwise.
Haven't been introduced and haven't been found. It's both. Microsoft's SDL has dramatically reduced number of 0-days in their products. I speculate that eliminating many common vulnerability classes also eliminates a lot of the low-hanging fruit that's easiest to spot in the binaries by reverse engineers. They have potential to raise the security even higher if they apply MS Research's tools like VCC or Dafny. I don't even know what Edge is written in, though.
"We’re determined to make Microsoft Edge the safest and most secure browser." Then open source the whole thing, not just little parts of it. It has the lowest number of vulnerabilities in the National Vulnerability Database because it has the least number of eyes able to look for them.
Earlier quoted context omitted.
Not sure what you mean, it has benefited from security researchers looking at the code base. They haven't found everything but they found many things.
He means the quality is so bad that users of it could get owned by full, remote execution on a regular basis. That some people saw some flaws didn't mean anything. There were some alternatives, including commercial, where people put extra effort into checking how crypto interfaced or the quality of the code. Some even used static analysis to find common flaws. As I say, the difference in 0-days between them and OpenS…
Good code is better than bad code obviously, but how do you know what you have if you can't see the source? It's Schrodinger's code, you don't know it's bad until it's too late.