Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list
1–10 of 137 posts
Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list
#2It's actually this bit from farther down that surprised me the most:
> 56 percent of exploits blocked in Q3 use Java vulnerabilities.
So much for the idea of a managed language runtime being inherently more secure...
Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list
#3Sorry for going off topic but, I hadn't seen the nextweb new design before. I found it quite disorientating, there is so much orange "stuff". I just didn't know where to look.
Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list
#4I usually get shouted down when I say this but Microsoft's focus on secure code over the last 10 years has paid off. Not only is the OS too hard a target hence the increase in Java, adobe product exploits, but their software running on their OS has fallen in line too.
I know the saying many eyes make bugs shallow, but so does billions of dollars and years of concentrated effort. Kudos to Microsoft for getting their act together.
Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list
#5This is the result of nearly a decade of work from MSFT, across the board. They built better tools, drilled security into every new hire all the way to the execs, made it a part of every engineering and product process imaginable. Happy that is finally being acknowledged on the outside.
Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list
#6It's actually this bit from farther down that surprised me the most: > 56 percent of exploits blocked in Q3 use Java vulnerabilities. So much for the idea of a managed language runtime being inherently more secure...
The runtime isn't written in a managed language, and that's where most of the vulnerabilities happen, right? The holes aren't in application code, but in _running arbitrary code_, which the JVM fails to do safely.
The surface area exposed is larger, because you're allowing the browser to download and run arbitrary programs, something you don't do with unmanaged languages very much.
Edit: Also, just consider how much worse it'd be if Java apps were re-written in a language that allows buffer overflows. Enterprises already cannot get security right; even generating SQL queries results in problems. No way would those teams deal with yet another layer of security issues. Hell, I've dealt with commercial teams writing in C++ thinking a buffer overflow has "something to do with network rate limiting."
Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list
#7It's actually this bit from farther down that surprised me the most: > 56 percent of exploits blocked in Q3 use Java vulnerabilities. So much for the idea of a managed language runtime being inherently more secure...
It is inherently more secured in the same context. The JVM applet sandbox has to stand up to random code off the internet, whereas native code is almost only installed explicitly.
Remember ActiveX and how it was worse than Java applets?
Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list
#8Sorry for going off topic but, I hadn't seen the nextweb new design before. I found it quite disorientating, there is so much orange "stuff". I just didn't know where to look.
I agree, it feels like a complete downgrade to me. It feels like they're trying to be Gawker.
Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list
#9It's actually this bit from farther down that surprised me the most: > 56 percent of exploits blocked in Q3 use Java vulnerabilities. So much for the idea of a managed language runtime being inherently more secure...
Well CLR seems to be OK so I think this is down to the implementation rather than the concept.
Re: Not one Microsoft product on Kaspersky’s top 10 vulnerabilities list
#10Sorry for going off topic but, I hadn't seen the nextweb new design before. I found it quite disorientating, there is so much orange "stuff". I just didn't know where to look.
I wasn't bothered by the colors so much as the layout. Almost every news source I read has the article all the way to the left, with navigation at the top and secondary content on the right. Having the navigation on the left and the content on the right was disorienting (and I've felt the same with Google's newer blog layouts). I can understand doing this on a tablet, but on a desktop it feels... overly simplified.