What does this say about using Google software versus software from Microsoft? Or am I missing something obvious?
Forming an opinion about Microsoft vs. Google software quality would require knowing how many similar problems Microsoft found and subsequently patched in their software. Without that data, we can't tell whether Microsoft isn't putting effort into finding vulnerabilities in its software, or whether Google simply got lucky and found something Microsoft missed.
And perhaps scaremongerings us to embrace the cloud, and thus ChromeOS...
- The original parsers / renderers where written on single user systems and focussed on rendering speed. They didn't anticipate hostile files.
- The original developers are long gone.
- EMF files were never popular on websites.
I would argue that their real mistake was adding EMF / WMF support to IE in the first place. It made sense to developers because it was only a few lines of code, but it was a terrible decision for security.
Your statement would also make it unreasonable for Google to be able to find this stuff, but we have existence proof that that's not the case.
His position is absurd. Microsoft could have found it. The thing stopping them is the incredible number of tests you would need to perform to find them all.
The OP asked why Microsoft didn't find this first. The answer is too many things to test. The entire premise of the argument is insane. If microsoft had a viable way to test ALL of the their products for ANY problem, don't you think they would be doing that?
As part of MS16-074, some of the bugs were indeed fixed, such as the EMR_STRETCHBLT record, which the original proof-of-concept image relied on. However, we've discovered that not all of the DIB-related problems are gone.