   As seen on slashdot: windows exploit based on leak released
  Apparently, someone has found an exploit in the windows source code that has been leaked. It didnt take very long, but the person found a buffer overflow type error in internet explorer 5 code which allows to create bitmaps that can execute malicious code.Internet explorer 6 doesn't have the problem, but someone could possibly create a virus that spreads among internet explorer 5 users (and possibly outlook 5 users, if they use the same bitmap loading code).An anonymous poster on slashdot has even posted a code sample showing the faulty code (which I won't post here, due to our friendly gamedev moderators). It seems very sad to see that such errors still make it in final software. Apparently, the programmer used a signed byte index, which allowed to write data on the stack.This seems like a fairly simple error. I personally always use unsigned integers for indices, which prevents such problems... I can't believe microsoft doesn't have the funds to hire more qualified programmers to work on their products. Microsoft will probably argue that this is one of the reasons they keep their source closed (to hide their mistakes).Looking for a serious game project?  www.xgameproject.com[edited by - Max_Payne on February 16, 2004 3:43:27 PM]
  Congrats, they found a bug that has already been fixed.  Good for them.CM ;  IE6 being a fix?Would have to see how many people still use IE5.Anyhow, the point is mostly that the bug should never have made it to a release version in the first place.   Looking for a serious game project?www.xgameproject.com;  I''m sorry, but I''ll be damned!You write a couple of million line of code and see if you don''t make any mistakes. I mean marketing strategies aside I think they do damn good work, but crap they can''t be perfect!!As I''m pretty sure you''re not!If you were so good you''d be making flawless OSes or, even sticking with your   technical level, games? But I''m pretty sure you don''t. So please don''t post with your elitist attitude. It''s not warranted. ;  Using source code individual finds overflow bug fixed several years ago (IE 5.5, IE 6).In other news, according to flaws Mozilla has so far admitted exist, the Mozilla browser averages one new arbitary code execution vulnerability every 60 days. In other news, experts continue to find countless buffer overflows that have existed in sendmail for years but are only just now being found, probably because they where obscured by several upper layers of buffer overflow vulnerabilities.In other news, Apache Team denies existence of gobbles root exploit for months, then after proof attempts to claim it only affects Windows and continue to do nothing for months, then after script kiddie ready version is released for BSD with promise from gobbles to release an all platform version if something isn''t done they finally do something and then complain when some people make a fuss about how late it is.In other news...(I could go on for some time, but then it would look like some sort of rant about the false believe of fan boys that open source is some sort of magic wand that makes security problems go away) ;  A flawless program. Ha.quote:Original post by Michalson  In other news...(I could go on for some time, but then it would look like some sort of rant about the false believe of fan boys that open source is some sort of magic wand that makes security problems go away)   God forbid.   [edited by - woodsman on February 16, 2004 3:57:34 PM];  I am currently making good 3D engines  And I pay attention to make sure I don't make that kind of mistakes.The amount of code lines you write doesn't matter. Its about putting some care in what you do. Choosing the right variable type is something that should be considered... I hate it when I see programmers that "don't care, as long as it works" and just keep making unstable code...Some people seriously need to realise that it IS possible to avoid ALOT of errors just by being careful. Heck, internet explorer is probably one of the most important pieces of software to keep secure on windows, so many people use it and its a network application...   No, open source does not make problems go away. Microsoft shouldn't have a real need to have its source open to fix security problems anyways, since they have so many programmers to look at it.Looking for a serious game project?  www.xgameproject.com [edited by - Max_Payne on February 16, 2004 4:01:36 PM];quote:Original post by Max_Payne  Anyhow, the point is mostly that the bug should never have made it to a release version in the first place.Mozilla has had buffer overflow errors in release code.  Bugs happen to everybody.  MS found this one, and fixed it.CM ;quote:Original post by Max_Payne  I am currently making good 3D engines  And I pay attention to make sure I don''t make that kind of mistakes.The amount of code lines you write doesn''t matter. Its about putting some care in what you do. Choosing the right variable type is something that should be considered... I hate it when I see programmers that "don''t care, as long as it works" and just keep making unstable code...Some people seriously need to realise that it IS possible to avoid ALOT of errors just by being careful. Heck, internet explorer is probably one of the most important pieces of software to keep secure on windows, so many people use it and its a network application...   No, open source does not make problems go away. Microsoft shouldn''t have a real need to have its source open to fix security problems anyways, since they have so many programmers to look at it.Looking for a serious game project?   www.xgameproject.com [edited by - Max_Payne on February 16, 2004 4:01:36 PM]I won''t pretend to know the exactly quality of your code, BUT! you must agree good != flawless && good != bugless. good == satisfactory_performance in this case. But like another poster said, it was found and fixed and not neglected for another 3 versions. I like I said before Windows the OS, IE, and its subcomponents are millions of lines long. Though they have lots of programmers, that doesn''t mean they''ll catch every mistake.... they''re human.;quote:Original post by Max_Payne   I can''t believe microsoft doesn''t have the funds to hire more qualified programmers to work on their products. Microsoft will probably argue that this is one of the reasons they keep their source closed (to hide their mistakes). Ya I kno.  MS is such loosers for wanting to keep source code locked.  I mean, if I had such a big ass company with millions in costs, with thousands of employees to pay salary to, and with competitors at my heals, I would definetly release all my source code so that everyone can look at it, and fix it, and maybe release their own versions and make their own billions, and I be happy knowing that I did the world a good thing by making others rich while my employees who are just as hard-working (but considered lazy sobs by some l33t fanboys) as any others don''t get paid. 