This is an incredible resource for anyone looking into zeroday exploits and I'm happy to say that I helped with ithttp://www.rand.org/pubs/research_reports/RR1751.html …
-
Many eyes (and open source) DO NOT make all bugs shallow. Linux among the highest life expectancy for exploits.pic.twitter.com/ILOUTqoPVi
AGAIN: efforts to patch or disclose your way to killing exploits don't work (*cough* Project Zero). Most die from code refactors.pic.twitter.com/tXF5rFI98J
-
-
If an exploit does get rediscovered, it gets rediscovered quickly... or not really at all.pic.twitter.com/nf7GfZ1dAP
-
Exploit buyers overwhelmingly purchase in response to direct, operational needs.pic.twitter.com/UNGL8wnC0K
- 10 more replies
New conversation -
-
-
I see a second-order deterrence effect: "There's no way we're going to avoid Project Zero press unless we refactor this tangled mess."
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Project Zero has contributed greatly to defensive code changes, for example hardening Flash
-
Think you're looking at this wrong way: Project Zero isn't just to find in-use vulnerabilities. It's to scuttle easy new exploits.
- 1 more reply
New conversation -
-
-
Any word on how long it takes to rebuild vuln stock after refactor? I.e. does refactoring improve code qual or just delay attacker?
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Q: are they effective enough between refactors?
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
So could we (or somebody w power, like Google) automate this defense. Refactor automatically and often. And use variants of code.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
With sample n=200 and obvious glaring systematic biases* not sure how reliable that data is *(0day Rand know of)
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.