we should all be using Rust then :)
or some language with the runtime. for example, c#?
Microsoft: 70 percent of all security bugs are memory safety issues
11–20 of 180 posts
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#12[flagged]
Obsessed much? This has no mentions of Rust anywhere.
Given it's Microsoft, they are probably thinking about .net.
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#13To quote the article:
```
Furthermore, as Microsoft has patched most of the basic memory safety bugs, attackers and bug hunters have also stepped up their game, moving from basic memory errors that spew code into adjacent memory to more complex exploits that run code at desired memory addresses, ideal for targeting others apps and processes running on the system.
```
Is all we can hope for in the security game a series of mitigations? As soon as we add layers of security (Stack cookies, ASLR, memory "safe" languages with exploitable runtimes, etc.) it seems like new methods are invented to bypass them and those methods gradually become widespread (ROP chains, runtime fuzzing, rowhammer, speculative execution exploits). What is the next "70 percent" of security bugs? Is there an end to this race?
I think the only thing in the future that can ever be as secure as in-person conversation and paper records is devices using zero-intermediary communication, in the style of an ansible https://en.wikipedia.org/wiki/Ansible, and extremely restricted storage which can only store data and not arbitrary application state.
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#14we should all be using Rust then :)
Maybe you can do a proof of concept by writing a mini-Linux using Rust.
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#15Linux is also written in C.
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#16To quote the article: ``` Furthermore, as Microsoft has patched most of the basic memory safety bugs, attackers and bug hunters have also stepped up their game, moving from basic memory errors that spew code into adjacent memory to more complex exploits that run code at desired memory addresses, ideal for targeting others apps and processes running on the system. ``` Is all we can hope for in the security game a seri…
Security is an arms race, in a quite literal sense of the term.
Arms races don't really ever end, except for truces/treaties or total victory.
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#17Re: Microsoft: 70 percent of all security bugs are memory safety issues
#18[flagged]
There's a lot of memory safe languages out there that are great choices. Coming from a Microsoft statement, .Net is pretty neat. When your worst case latency/perf requirements don't allow you to have a GC, Rust is another great choice.
What exactly is .Net in this context? Every time I think I understand it someone throws a curve ball. Is it c#? Is it a set of libraries?
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#19[flagged]
There's a lot of memory safe languages out there that are great choices. Coming from a Microsoft statement, .Net is pretty neat. When your worst case latency/perf requirements don't allow you to have a GC, Rust is another great choice.
What about when you want a concurrency safe language? You can still have concurrency bugs, like race conditions in languages that are only memory safe.
Re: Microsoft: 70 percent of all security bugs are memory safety issues
#20Where can I find the original presentation from Microsoft's engineer?