Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft: 70 percent of all security bugs are memory safety issues

zdnet.com

Post reply on HN
Print view View original

151–160 of 180 posts

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#151

Post by pjmlp »

mike_hearn wrote: post #150
pjmlp wrote: post #137

Earlier quoted context omitted.

Midori was a victim of the WinDev vs DevDiv political wars. The most recent example is Kenny Kerr complaining that although they made a big effort to migrate from C++/CX into C++/WinRT, the large majority prefers to code in .NET nowadays. https://kennykerr.ca/2019/01/25/the-state-of-cpp-on-windows/ However many of the Midori outcomes have landed in .NET, namely .NET Native, async/await, TPL, span, blittable structs,…

Was it? How do you know that? As far as I am aware the only public information on Midori comes from Joe Duffy's blog which didn't discuss why it got cancelled. Beyond the general issue of the well known managed vs unmanaged wars within MS, it would appear to be the case that Midori sucked up massive investment within MS and had little to show for it in the end - a nearly 10 year effort to build a fully managed OS, bu…

Joe Duffy has made a few mentions to it in his keynotes and some tweets.

At Rustconf he clearly mentions that in spite of having the system running in front of them, WinDev wasn't willing to believe in them.

Which given how WinDev sabotaged Longhorn to reboot .NET ideas into COM and getting COM Runtime reborn as WinRT, I would believe him.

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#152

Post by stochastic_monk »

atoav wrote: post #78
Thaxll wrote: post #50

Earlier quoted context omitted.

Right because Rust will prevent all the issues of Unsafe usage that an OS uses all the time ...

Say the same thing about seatbelts in a car. If you don’t plan to have accidents, why do you need seatbelts? Car accidents, like mistakes in programming are a risk that has a likelyhood that is non-zero. A seatbelt might be a little bit annoying when things go well, but much less so when they don’t. Rust is there to stop you in most cases when you try to accidentally shot yourself into the leg, unless you deliberatel…

There’s a similar distinction between most C++ development and dropping to low-level placement new, mallocs/frees, handwritten assembly or heavy use of intrinsics. You rarely need the latter, and, once wrapped, when used by the former is quite safe. The difference is that Rust was designed with this in mind.

I like Rust; I’ve done some coding challenges in it. It won’t replace C++ for me for quite some time, but it’s about time there was a safe, powerful language that’s truly a worthy contender.

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#153

Post by nineteen999 »

pjmlp wrote: post #146
nineteen999 wrote: post #46

Earlier quoted context omitted.

Microsoft haven't even rewritten Office in C#/.Net yet, what makes you think they are ready to rewrite/replace the Windows kernel with it? https://news.ycombinator.com/item?id=17305332

How do you think Office 365 works?

A bunch of tiny pjmlp's running around in a hamster wheel providing electricity maybe?

Are you suggesting the post I linked above from someone claiming to be an engineer on Office is inaccurate? It may be well be, but it sounds more plausible and supportable than whatever question it is you seem to be posing.

If you have evidence to suggest that Office365 is written in C# these days I'd like to see it please, because I have read on more than one occasion over the last 10 years that MS had attempted this and given up.

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#154

Post by pjmlp »

nineteen999 wrote: post #153
pjmlp wrote: post #146

Earlier quoted context omitted.

How do you think Office 365 works?

A bunch of tiny pjmlp's running around in a hamster wheel providing electricity maybe? Are you suggesting the post I linked above from someone claiming to be an engineer on Office is inaccurate? It may be well be, but it sounds more plausible and supportable than whatever question it is you seem to be posing. If you have evidence to suggest that Office365 is written in C# these days I'd like to see it please, because…

I was referrring to Office 365 on Azure, which happens to run on the browser in case you missed it.

Quoting your favourite engineer "The desktop app’s are fully native".

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#155

Post by gnuvince »

ilovecaching wrote: post #75

Rust couldn't solve all of these bugs, but it certainly would have drastically reduced the total amount. The code would also be drastically easier to write and debug. C++17 is still a total mess to write, despite what Microsoft might tell you in their docs. Really doesn't make sense to me, outside of the sunk cost fallacy, why Microsoft isn't pivoting to Rust if they want to write C++.

> Rust couldn't solve all of these bugs, but it certainly would have drastically reduced the total amount.

Well there's certainly a chronological argument that it couldn't have, but I agree with the sentiment. It saddens me that our industry is one in which people _do_ let perfect be the enemy of better.

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#156

Post by nineteen999 »

pjmlp wrote: post #154
nineteen999 wrote: post #153

Earlier quoted context omitted.

A bunch of tiny pjmlp's running around in a hamster wheel providing electricity maybe? Are you suggesting the post I linked above from someone claiming to be an engineer on Office is inaccurate? It may be well be, but it sounds more plausible and supportable than whatever question it is you seem to be posing. If you have evidence to suggest that Office365 is written in C# these days I'd like to see it please, because…

I was referrring to Office 365 on Azure, which happens to run on the browser in case you missed it. Quoting your favourite engineer "The desktop app’s are fully native".

So you are talking about "Office 365 Mobile" and/or "Office 365 Online".

There is also "Office 365 Desktop" which is what I think you'll find most large corporations that have migrated from Office 2016 Desktop apps are using.

https://www.howtogeek.com/334597/whats-the-difference-betwee...

Office 365 Mobile/Online are much cut down, more comparable from Google Docs from the sounds of it, and hardly a 1:1 replacement for the Desktop apps. Which are still C/C++.

In addition, if you have any hard evidence that the majority of the Office Mobile/Online web apps are written in C# I would like to see that, because I can't seem to find any.

Thankyou.

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#157

Post by naikrovek »

maxxxxx wrote: post #129
naikrovek wrote: post #128

Earlier quoted context omitted.

There is NO graphical Win32 stuff; UWP only. There are some non-graphical Win32 APIs but not like full Windows. It's basically .net core and UWP and all the old familiar Windows stuff is gone. IoT Core is either the best possible Windows or the worst possible Windows, depending on your point of view. For some things, it's a perfect fit. If you can't fit into a .net core & UWP ecosystem entirely then it won't be a goo…

UWP is a no-go already. No way we can port our WPF code.

Well, UWP and WPF are close cousins, so it probably isn't as bad as one would think if they didn't know that. They're both XAML, though they are not quite the same.

The main thing is that with WPF you can use the same Win32-type logic you've always been using. UWP is it's own API entirely. It's not all that different, but it is different. Things are organized better and APIs make more sense in UWP-land to me.

So the gui would probably port over relatively easily. The application logic probably wouldn't.

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#158

Post by nineteen999 »

monocasa wrote: post #67
dmarlow wrote: post #58

Earlier quoted context omitted.

Why is that?

Office is somewhere around an order of magnitude of so more code, everything I've heard is that it's nightmare fuel levels of legacy code that defies even refactoring within the same language, and has a bad habit of slurping up binary formats and doing crazy internal YOLO pointer chasing.

> and has a bad habit of slurping up binary formats and doing crazy internal YOLO pointer chasing.

... you know that this about what 9/10th's of an operating systems device driver code look like, right?

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#159

Post by pjmlp »

nineteen999 wrote: post #156
pjmlp wrote: post #154

Earlier quoted context omitted.

I was referrring to Office 365 on Azure, which happens to run on the browser in case you missed it. Quoting your favourite engineer "The desktop app’s are fully native".

So you are talking about "Office 365 Mobile" and/or "Office 365 Online". There is also "Office 365 Desktop" which is what I think you'll find most large corporations that have migrated from Office 2016 Desktop apps are using. https://www.howtogeek.com/334597/whats-the-difference-betwee... Office 365 Mobile/Online are much cut down, more comparable from Google Docs from the sounds of it, and hardly a 1:1 replacement f…

If you have any hard evidence that the majority of the Office Mobile/Online web apps are written in C++ I would like to see that, because I can't seem to find any.

Thankyou.

Re: Microsoft: 70 percent of all security bugs are memory safety issues

#160

Post by maxxxxx »

naikrovek wrote: post #157
maxxxxx wrote: post #129

Earlier quoted context omitted.

UWP is a no-go already. No way we can port our WPF code.

Well, UWP and WPF are close cousins, so it probably isn't as bad as one would think if they didn't know that. They're both XAML, though they are not quite the same. The main thing is that with WPF you can use the same Win32-type logic you've always been using. UWP is it's own API entirely. It's not all that different, but it is different. Things are organized better and APIs make more sense in UWP-land to me. So the…

The GUI would be the easy part but our applications have a lot of background logic. Going to UWP would be almost a complete rewrite without actually improving anything. From what I have seen so far UWP is just different but not really better than WPF.
Post reply on HN