Technology

59396 readers

2618 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

255

Microsoft points finger at the EU for not being able to lock down Windows (www.neowin.net)

submitted 3 months ago by [email protected] to c/technology

92 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 6 points 3 months ago (1 children)

How would you prove that no input exists that could crash a piece of code? The potential search space is enormous. Microsoft can't prevent drivers from accepting external input, so there's always a risk that something could trigger an undetected error in the code. Microsoft certainly ought to be fuzz testing drivers it certifies but that will only catch low hanging fruit. Unless they can see the source code, it's hard to determine for sure that there are no memory safety bugs.

The driver developers are the ones with the source code and should have been using analysis tools to find these kinds of memory safety errors. Or they could have written it in a memory safe language like Rust.

[–] [email protected] 1 points 3 months ago (1 children)

You don't need to prove that no input can crash the code. "Exhaustive testing is not possible" is one of the core testing principles, ISTQB teaches that. As far as we know, the input was a file filled with zeroes, and not some subtle configuration or instruction. That can definitely be expected, tested, and handled.

[–] [email protected] 3 points 3 months ago (1 children)

As far as we know, the input was a file filled with zeroes

CrowdStrike have said that was not the problem:

This is not related to null bytes contained within Channel File 291 or any other Channel File.

That said, their preliminary incident review doesn't give us much to go on as to what was wrong with the file.

You're speculating that it was something easy to test for by a third party. It certainly could have been but I would hope it's a more subtle bug which, as you say, can't be exhaustively tested for. Source code analysis definitely would have surfaced this bug so either they didn't bother looking or didn't bother fixing it.

[–] [email protected] 2 points 3 months ago

You’re speculating that it was something easy to test for by a third party.

Based on the data that I have, which is of course very limited! I didn't know about the recent news regarding the null bytes, thank you for sharing this info.