Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft: 70 percent of all security bugs are memory safety issues

zdnet.com

Post reply on HN
Print view View original

31–40 of 180 posts

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#31

Post by est31 »

PopsiclePete wrote: post #24
vardump wrote: post #19

Earlier quoted context omitted.

What about when you want a concurrency safe language? You can still have concurrency bugs, like race conditions in languages that are only memory safe.

Of all the stories Rust tries to sell me on, concurrency is by far the weakest of all. Rust concurrency is a mess compared to (yes, I'm going to say it) Go. Async/await are still far away from being anywhere near figured out nor implemented, CSP primitives in the std. lib like std::mpsc are basically DOA/obsolete/half-functioning and tokio/futures are still early alpha. There's a lot more to concurrency than just com…

Don't get what you mean by std::mpsc being half-functioning. I'm using it and it works great. Obsolete, maybe. There are alternative implementations out there that have various improvements, but any non-trivial core primitive of a healthy language has that, no?

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#32

Post by vardump »

PopsiclePete wrote: post #24
vardump wrote: post #19

Earlier quoted context omitted.

What about when you want a concurrency safe language? You can still have concurrency bugs, like race conditions in languages that are only memory safe.

Of all the stories Rust tries to sell me on, concurrency is by far the weakest of all. Rust concurrency is a mess compared to (yes, I'm going to say it) Go. Async/await are still far away from being anywhere near figured out nor implemented, CSP primitives in the std. lib like std::mpsc are basically DOA/obsolete/half-functioning and tokio/futures are still early alpha. There's a lot more to concurrency than just com…

I actually agree with you. I'll just gladly take any available advances in concurrency safety. In any concurrency models, including shared data.

Async/await (and production quality gRPC) is currently what's keeping us from using Rust at dayjob.

> There's a lot more to concurrency than just compile-time verification of safe usage of a mutex or moving data in/out of a thread. A lot more.

Sure, but it's better to have at least that.

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#35

Post by devhead »

cevn wrote: post #17
mrinterweb wrote: post #7

Earlier quoted context omitted.

Remember, and I think it goes without saying, any rust rewrite of any scope of project is always trivial, and should be talked about as if a full rewrite naturally will be trivial. Proceed.

In the time it took to write this comment I rewrote Windows 10 in rust twice.

approved for release, we'll test it live!

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#37

Post by monocasa »

Waterluvian wrote: post #28
ComputerGuru wrote: post #26

Earlier quoted context omitted.

It’s the CLR (common language runtime) running in a JIT environment.

Okay thanks. I could Google that. So it's code written in C# or VB or another supported language, compiled by JIT to a common bytecode running on a virtual machine and probably a whole slew of libraries that target that VM too. Okay. I have no idea why I'm struggling so much with that. Thanks.

Microsoft heavily obfuscated the term for some reason.

I swear, they would've named Bill Gates' grand kids .Net Gates if they could have gotten away with it.

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#38

Post by Waterluvian »

monocasa wrote: post #37
Waterluvian wrote: post #28

Earlier quoted context omitted.

Okay thanks. I could Google that. So it's code written in C# or VB or another supported language, compiled by JIT to a common bytecode running on a virtual machine and probably a whole slew of libraries that target that VM too. Okay. I have no idea why I'm struggling so much with that. Thanks.

Microsoft heavily obfuscated the term for some reason. I swear, they would've named Bill Gates' grand kids .Net Gates if they could have gotten away with it.

Yeah. I think that's it. I remember .net passport as a kid. Among things. .net server stuff. Etc.

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#39

Post by raymond_goo »

ip26 wrote: post #16
sempron64 wrote: post #13

To quote the article: ``` Furthermore, as Microsoft has patched most of the basic memory safety bugs, attackers and bug hunters have also stepped up their game, moving from basic memory errors that spew code into adjacent memory to more complex exploits that run code at desired memory addresses, ideal for targeting others apps and processes running on the system. ``` Is all we can hope for in the security game a seri…

Security is an arms race, in a quite literal sense of the term. Arms races don't really ever end, except for truces/treaties or total victory.

No, just use Rust...

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#40

Post by est31 »

21 wrote: post #29
sempron64 wrote: post #13

To quote the article: ``` Furthermore, as Microsoft has patched most of the basic memory safety bugs, attackers and bug hunters have also stepped up their game, moving from basic memory errors that spew code into adjacent memory to more complex exploits that run code at desired memory addresses, ideal for targeting others apps and processes running on the system. ``` Is all we can hope for in the security game a seri…

It's about increasing the costs to the attacker. Now a Windows/browser zero-day requires months of research and can be sold for $100k+.

Yes, the goal is to increase the costs to the attacker as much as possible while having minimal added costs during development and runtime of the software. Statically proven programs are great security wise but they are expensive to produce, while adding ASLR is not perfect but comparatively easy to pull off.
Post reply on HN