Chromium project finds that 70% of security defects are memory safety problems

Re:Chromium project finds that 70% of security defects are m... by pjmlp on Sunday May 24, 2020 @07:17AM (#23290763)

You are ignoring 32 years of proven C exploits since Morris worm introduced in 1988, UNIX kernel exploits, including those that Linux collects every year, which lead to Microsoft (Azure Sphere), Google (Android 11), Apple (iPhone X) and Oracle (Solaris SPARC) enforcing hardware memory tagging.

Which happen to be written in C with several layers of code review and static analysis.

So by your reasoning those 32 years have not happened, in spite of being so easy to prevent exploits in C code.

Yeah, right.

[ Parent | on HN ]

Re:Chromium project finds that 70% of security defects are m... by mmmNZ1 on Sunday May 24, 2020 @07:34AM (#23290820)

Oh, poor Microsoft is forced to use bad bad C-Linux on their Interweb service!

All while their own industrial strength C++-OS (according to you) never has any exploits.

The fact that you are singling out Linux shows that you are only interested in throwing dirt.

[ Parent | on HN ]

Re:Chromium project finds that 70% of security defects are m... by sayusasugi on Sunday May 24, 2020 @09:43AM (#23291453)

Are you joking? Both C and C++ are equally littered with unsafe "features".

[ Parent | on HN ]

Re:Chromium project finds that 70% of security defects are m... by pjmlp on Sunday May 24, 2020 @01:09PM (#23292901)

I can give you as many UNIX security exploit examples as you feel like having, no need to single out Linux.

[ Parent | on HN ]

Re:Chromium project finds that 70% of security defects are m... by amakk on Sunday May 24, 2020 @01:35PM (#23293103)

It is not about UNIX vs. Linux, it is about the fact that you are always protecting Microsoft, like just now.

I wonder why.

[ Parent | on HN ]

Re:Chromium project finds that 70% of security defects are m... by pjmlp on Sunday May 24, 2020 @05:40PM (#23295071)

Someone woke up in the 90's it seems.

Here is a little tip for you, Microsoft has been acknowledging security issues with C and C++ since the XP SP2 days.

Which is why Windows happens to have plenty of mitigations that only recently FOSS UNIX clones are catching up to.

Yet they have come public that hasn't been enough, hence the migration effort away from C, enforcing programming guidelines with C++ and coming up with plans to migrate to safer systems programming languages.

Guess which OS vendor is now having first party support for writing GUIs in Rust?

But I can also rephrase what Oracle, Apple and Google have stated in the same vein regarding OS security.

Or maybe you prefer the statements of an UNIX hero instead?

[ Parent | on HN ]