Hacker News new | past | comments | ask | show | jobs | submit login

“70% of security vulnerabilities caused by memory safety problems”

This is only true in certain contexts isn’t it?

I seem to recall reading recently that some very high percentage of web security holes are caused by insecure exposed functions.




Here is the context which is probably process type vulnerabilities in most people minds:

"Around 70 percent of all the vulnerabilities in Microsoft products addressed through a security update each year are memory safety issues"

https://www.zdnet.com/article/microsoft-70-percent-of-all-se...


Google also makes claims[1] corroborating this ratio in their own work. It's an endless ammo supply for the memory safety argument. (The linked story doesn't argue otherwise, despite the headline.)

[1] https://www.chromium.org/Home/chromium-security/memory-safet...


That is correct. Measurements including all vulnerabilities have memory safety ones somewhere in the ballpark of 15%. A pretty extreme minority overall.

This doesn’t gel with the hive mind though, so you probably won’t see it pop up terribly often.


So in fact this whole shebang about memory safety is driven by a statistic about memory safety errors in Microsoft products.

And yet the memory safety advocates everywhere are waving that number around like 70% of all security issues are caused by memory safety.

I note Chromium project also says "The Chromium project finds that around 70% of our serious security bugs are memory safety problems." https://www.chromium.org/Home/chromium-security/memory-safet...

Then you get headlines like this: "Microsoft: 70 percent of all security bugs are memory safety issues", which is flat out wrong and contradicts itself the first line of the article.

https://www.zdnet.com/article/microsoft-70-percent-of-all-se...

The HN post that we are commenting on even says "To me, the fact 70% of security vulnerabilities arise from a lack of memory safety is not the reason that memory safety is important." which is also false and certainly needs clarification.


Perhaps the correct statement is something like "70% of security vulnerabilities in large projects written in C or C++ are memory safety issues", with the understanding that there are both a lot of software that are and aren't subject to that statistic.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: