Software Security Vulnerabilities
Discussions focus on the prevalence of exploitable bugs and security holes in software, especially open source projects like OpenSSL and Linux, challenging claims that widespread scrutiny eliminates such issues.
Activity Over Time
Top Contributors
Keywords
Sample Comments
Vulnerabilities often arise from implementation bugs, no?
the reason we needed CVE is due to the fallacy of “99% are unexploitable”. memory and logic bugs are a time bomb. you dont need 1 big exploit, only a system that is put together poorly enough to have the bugs in the first place.
This is not about bugs, there will always be bugs. These are security HOLES.
That's a bit naive... Just two examplesOpenSSL has had 22 vulnerabilities in 2016 so far [1]Linux has has 336 vulnerabilities in 2016 so far [2][1] https://web.nvd.nist.gov/view/vuln/statistics-results?adv_se...[2] <a href
The problem with that is security bugs.
its not like there are no security vulnerabilities in FOSS apps either
That is entirely fallacious reasoning. Your programs could be full of exploitable bugs (and they probably are) yet nobody knows or cares enough to exploit them. OpenSSL had trivial errors unchecked and presumably unexploited for years.
You mean their consistently bad security track record makes their bugs less suspicious?
Some do, some don't and don't consider it a vulnerability when reported.
That seems beside OP's point.They are speaking of the potential bugs and security vulnerabilities all that code might/probably has, given track records.