Fewest vulnerabilities: I suspect that Chrome and Firefox being open source is a factor here. Thus it seems possible to me that they actually have fewer vulnerabilities than Edge—Edge’s just haven’t been found yet. This is pure speculation on my part; I have no evidence nor any investigation, deep or otherwise.
Introducing Windows Defender Application Guard for Microsoft Edge
51–59 of 59 posts
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#52Earlier quoted context omitted.
>A closed development with good effort is more trustworthy than an open one with low effort or review. Good code is better than bad code obviously, but how do you know what you have if you can't see the source? It's Schrodinger's code, you don't know it's bad until it's too late.
Independent review of source with published hash for binary or analysis of assembly to compare it to baseline. Many problems that due diligence avoids can be detected at ASM level. You'd know they were at least doing that.
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#53Earlier quoted context omitted.
He means the quality is so bad that users of it could get owned by full, remote execution on a regular basis. That some people saw some flaws didn't mean anything. There were some alternatives, including commercial, where people put extra effort into checking how crypto interfaced or the quality of the code. Some even used static analysis to find common flaws. As I say, the difference in 0-days between them and OpenS…
>A closed development with good effort is more trustworthy than an open one with low effort or review. Good code is better than bad code obviously, but how do you know what you have if you can't see the source? It's Schrodinger's code, you don't know it's bad until it's too late.
OpenSSL is a good example of this, because even seasoned programmers trusted the code on the good name of the project and a few notable personalities. All the while told, "Don't write crypto code. It's too hard, let the experts handle it."
And look where that has gotten us. A million eyes all glazed over the same bug.
I'm unaware of concrete evidence that open sourcing code affects security outcomes either way. Do you have any examples?
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#54Earlier quoted context omitted.
>A closed development with good effort is more trustworthy than an open one with low effort or review. Good code is better than bad code obviously, but how do you know what you have if you can't see the source? It's Schrodinger's code, you don't know it's bad until it's too late.
Open sourcing it really only assuages a very tiny sum of people on this axis, as the vast majority of people simply cannot evaluate the code once they have it. They have to trust someone else, the same as they do for vendors. OpenSSL is a good example of this, because even seasoned programmers trusted the code on the good name of the project and a few notable personalities. All the while told, "Don't write crypto cod…
An impossible standard, how do you purpose to measure that?
>And look where that has gotten us. A million eyes all glazed over the same bug.
How is a less eyes a solution to that problem?
Allow me this thought experiment: One person holds up a black box and asks you to stick your hand inside promising up and down that it is not full of venomous snakes, another person does the same with a transparent box. You are blind, but there are some well meaning (though not perfect) people in the room who don't want to see you hurt and they see no snakes in the clear box. What box do you choose?
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#55Fewest vulnerabilities: I suspect that Chrome and Firefox being open source is a factor here. Thus it seems possible to me that they actually have fewer vulnerabilities than Edge—Edge’s just haven’t been found yet. This is pure speculation on my part; I have no evidence nor any investigation, deep or otherwise.
Also keep in mind that almost no-one is using edge: 4 till 5% browser market share (depending on the source used for such data). Whereas Chrome has a 25-35% market share (again, depending on source). It's just plain obvious that people don't want to put in a lot of effort to find a vulnerability as their target audience/ ROI is only so little...
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#56Earlier quoted context omitted.
Independent review of source with published hash for binary or analysis of assembly to compare it to baseline. Many problems that due diligence avoids can be detected at ASM level. You'd know they were at least doing that.
How do you pay for the audits without a conflict of interest? Unless it is crowdfunded in some way, the auditors would have incentives to not find anything.
I also can't overemphasize having clear standards to evaluate against. Then, you can have it done in a jurisdiction with strong contract law where they legally have to check it against the evidence. Make sure they publish a statement to the effect of what criteria it met to what degree. Potential to use lawsuits against them.
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#57Earlier quoted context omitted.
Open sourcing it really only assuages a very tiny sum of people on this axis, as the vast majority of people simply cannot evaluate the code once they have it. They have to trust someone else, the same as they do for vendors. OpenSSL is a good example of this, because even seasoned programmers trusted the code on the good name of the project and a few notable personalities. All the while told, "Don't write crypto cod…
>I'm unaware of concrete evidence that open sourcing code affects security outcomes either way. Do you have any examples? An impossible standard, how do you purpose to measure that? >And look where that has gotten us. A million eyes all glazed over the same bug. How is a less eyes a solution to that problem? Allow me this thought experiment: One person holds up a black box and asks you to stick your hand inside promi…
Number of compromises for product/system X vs open alternatives. Number of published vulnerabilities. Time to patch them. Evaluation of binaries for common issues showing if even basic, due diligence was applied. Results of independent evaluations against meaningful criteria, such as QA methods used & results of them. There's quite a few ways to assess this.
"How is a less eyes a solution to that problem?"
How is no eyes looking at specific OSS a solution to the problem? Pointless questions not focusing on the issue.
"Allow me this thought experiment: One person holds up a black box and asks you to stick your hand "
Now, lets say the same thing happens FOSS-style. The box is clear but people dive in blindfolded without being asked. That's vast majority of FOSS with negligible security benefit. Next, someone looks at the box but has neither seen a snake nor knows which are venomous. This is people glancing at the code. Lets say they know 1 or 2 venomous snakes, ask they be removed, and dive into the others because they didn't know how to spot them. This is amateurs or pro's with little domain knowledge knocking out low-hanging fruit (err, snakes). Finally, let's say an expert on all poisonous snakes puts significant time inspecting the box to make sure no adults or even babies lurk in there. After they're gone, the expert inserts their hand with no damage unless a new type of snake was hidden in there.
I choose the box where an expert looked inside to remove as many dangers as possible. I don't care if it's open or closed for my baseline: just that it was vetted by reliable people with evidence it's the same box. Most proprietary and FOSS software doesn't meet this standard although it was mostly proprietary that reached highest level of proof. Took a lot of expensive experts years to do it is why. FOSS theoretically has an advantage due to free labor but they just don't do high-security. Hard to get them to use safer, systems languages and unit testing much less high-security methods.
So, there's your example. It withers away once the truth is once again demonstrated: it's the review(s), what was reviewed, and if you trust reviewer or review methods. OSS only helps in rare case that more pro's or experts are interested in doing that. It occasionally happens but too rare to be the rule for the baseline.
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#58Two related projects, both with copy-on-write "forks" of disk storage and OS memory, creating disposable VMs with hardware-enforced memory isolation. Cappsule (open-source for Linux), https://cappsule.github.io virtualize any software on the fly (e.g. web browser, office suite, media player) into lightweight VMs called cappsules. Attacks are confined inside cappsules and therefore don’t have any impact on the host OS…