Microsoft Edge: Building a safer browser

Re:Microsoft Edge: Building a safer browser by comex on Monday May 11, 2015 @08:09PM (#9528694)

> MemGC (Memory Garbage Collector) is a memory garbage collection system that seeks to defend the browser from UAF (Use-after-free) vulnerabilities by taking responsibility for freeing memory away from the programmer and instead automating it, only freeing memory when the automation has detected that there are no more references left pointing to a given block of memory.

Interesting; I don't think this has been announced before. It sounds similar in concept to Chrome's Oilpan (still not shipped AFAIK).

[ Parent | on HN ]

Re:Microsoft Edge: Building a safer browser by wfh on Tuesday May 12, 2015 @01:42AM (#9529772)

This is not just "delay free", which is already in IE?

http://blog.trendmicro.com/trendlabs-security-intelligence/m...

[ Parent | on HN ]

Re:Microsoft Edge: Building a safer browser by Animats on Monday May 11, 2015 @09:12PM (#9528947)

What is Edge written in? I would have assumed Microsoft would use C#, which is garbage collected.

[ Parent | on HN ]

Re:Microsoft Edge: Building a safer browser by nbevans on Monday May 11, 2015 @09:25PM (#9528993)

Highly unlikely. It would be written as a native C++ app. Whilst the .NET CLR is very powerful and highly performant these days, there just wouldn't be enough justification I don't think to design their web browser on it. Remember this thing will be targeting mobile devices too. So every little performance optimisation can save minutes of battery life which all adds up.

That said, I've always wondered what a JavaScript implementation built on top of the CLR might behave like.

[ Parent | on HN ]

Re:Microsoft Edge: Building a safer browser by nerraga on Monday May 11, 2015 @09:46PM (#9529086)

The fact that the article is mentioning MemGC as a defense against use-after-free attacks (something I don't believe managed languages need be concerned) and the way Control-Flow-Guard is described leads me to think it's primarily C++. Probably a mix of native/managed, but I suspect that any managed code is kept to a minimum given the emphasis on native protection and countermeasures. If this is the case then I'd be interested in their rationale in deciding not to go 100% managed.

[ Parent | on HN ]

Re:Microsoft Edge: Building a safer browser by comex on Monday May 11, 2015 @11:21PM (#9529402)

As a fork of Trident, it's written in C++.

[ Parent | on HN ]