Hacker News Reader

Comment by 0xFFFFFFFFF | Hacker News Reader

Can I ask you why? I mean, I know about memory safety and stuff, but it is that bad?

Independent researches (Microsoft/Mozilla) showed that around 70% of security vulnerabilities are caused by memory safety bugs. That's one heck of a "memory safety and stuff" :)

Here's one reference: https://msrc-blog.microsoft.com/2019/07/18/we-need-a-safer-s...

"memory safety bugs" sounds pretty broad. What sort of vulnerability doesn't involve memory access?

its “memory safety”, not “accesses memory”

Something like SQL injection is a vulnerability that is not exploiting a memory error.

That reference and the original blog post where 70% was indicated is only dealing with security vulnerabilities in Microsoft's software, not everyone's.

So while other software that isn't Microsoft most certainly has memory safety bugs, this blog doesn't speak for those, only Microsoft's.

The only part that Mozilla is indicated is in reference to Rust.

If one of the largest software companies around can't get memory safety right, it does make a guy start to think that maybe most people should avoid having to handle it if they can.

I don't have a fully developed opinion on that, so I won't try to come up with one on the spot. My comment is purely because I felt the parent left out details about the blog post that should have been pointed out.

Google has done similar research on their codebases and found results in line with Microsoft’s.

Yes it is.

Reply on news.ycombinator.com