<story><title>Cryptic Rumblings Ahead of First 2020 Patch Tuesday</title><url>https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/</url></story><parent_chain></parent_chain><comment><author>sys32768</author><text>I wonder if Windows 7 will get this on its end of support day tomorrow.</text></comment>
<story><title>Cryptic Rumblings Ahead of First 2020 Patch Tuesday</title><url>https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/</url></story><parent_chain></parent_chain><comment><author>computator</author><text>It&amp;#x27;s a shame that mathematically proving correctness of code, &lt;i&gt;even for extremely important code&lt;/i&gt;, is never done.&lt;p&gt;I wonder how many lines of code in crypt32.dll. Is it on the order of 7500 lines? If Microsoft spent a few man-years mathematically proving the correctness of that code, they could have the saved the world about 10,000 man-years.&lt;p&gt;Windows has a user base of 1 billion[1]. A ballpark figure for proving the correctness of 7500 lines of very complex code[2] is about 30 man years[3]. If even 1% of the 1 billion Windows users and sysadmins has to spend a couple hours on things related to this patch, it works out to 9615 man-years of worldwide waste (based on an 8 hour workday and 260 workdays a year).&lt;p&gt;Had there been a wide-spread exploit, it could have cost the world millions of man-years.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Usage_share_of_operating_systems&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Usage_share_of_operating_syste...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.schneier.com&amp;#x2F;blog&amp;#x2F;archives&amp;#x2F;2009&amp;#x2F;10&amp;#x2F;proving_a_compu.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.schneier.com&amp;#x2F;blog&amp;#x2F;archives&amp;#x2F;2009&amp;#x2F;10&amp;#x2F;proving_a_com...&lt;/a&gt;&lt;p&gt;[3] Professor Gernot Heiser, the John Lions Chair in Computer Science in the School of Computer Science and Engineering and a senior principal researcher with NICTA, said for the first time a team had been able to prove with mathematical rigour that an operating-system kernel—the code at the heart of any computer or microprocessor—was 100 per cent bug-free and therefore immune to crashes and failures. Verifying the kernel—known as the seL4 microkernel—involved mathematically proving the correctness of about 7,500 lines of computer code in a project taking an average of six people more than five years.</text></comment>