Microsoft: 70 percent of all security bugs are memory safety issues
1–10 of 180 posts
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#2we should all be using Rust then :)
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#3we should all be using Rust then :)
I knew this comment was coming :)))
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#4Just a painful reminder that they scrapped Midori[0] their managed Operating System based on Microsoft Research's Singularity project[1].
Even if it only replaced Windows LTSB/Embedded, I'd still prefer an ATM, checkout, or gas station terminal I was using was running on managed code. Doubly so for the next generation of Nuclear Powered submarines[3].
Plus between virtualisation and silo-ed software management ("Apps") it seems entirely plausible to move the PC/Laptop to the next generation.
[0] https://en.wikipedia.org/wiki/Midori_(operating_system)
[1] https://en.wikipedia.org/wiki/Singularity_(operating_system)
[3] https://mspoweruser.com/uks-nuclear-submarines-runs-windows-...
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#5[flagged]
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#6Re: Microsoft: 70 percent of all security bugs are memory safety issues
#7[flagged]
Remember, and I think it goes without saying, any rust rewrite of any scope of project is always trivial, and should be talked about as if a full rewrite naturally will be trivial. Proceed.
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#8[flagged]
There's a lot of memory safe languages out there that are great choices. Coming from a Microsoft statement, .Net is pretty neat.
When your worst case latency/perf requirements don't allow you to have a GC, Rust is another great choice.
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#9Just a painful reminder that they scrapped Midori[0] their managed Operating System based on Microsoft Research's Singularity project[1]. Even if it only replaced Windows LTSB/Embedded, I'd still prefer an ATM, checkout, or gas station terminal I was using was running on managed code. Doubly so for the next generation of Nuclear Powered submarines[3]. Plus between virtualisation and silo-ed software management ("Apps…
I'd strongly prefer that my ATM had no start menu, file picker, online help system, interactive parts of update system, or any of the thousands of other UI apps which could be exploited via touchscreen if accidentally activated.
Singlularity would be cool, but I'd prefer smaller footprint to begin with.
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#10> Terms like buffer overflow, race condition, page fault, null pointer, stack exhaustion, heap exhaustion/corruption, use after free, or double free --all describe memory safety vulnerabilities.
Page faults are fine. Null pointers are fine; just don't dereference them. Race condition is a much more general term that can cover non-memory races too; perhaps they meant data races.