Can you point to remote execution issues in the CLR? I'm having a rather hard time thinking of any that'd impact an organization. The CLR issues with unsafe code has almost entirely been related to trying sandbox binaries (via CAS or loading .NET apps via browser plugins (same as Java)).
I'm unaware of any time the CLR would provide any useful attack surface. The only ones that come to mind are GDI+ issues that .NET inherits via passthrough. So, citation needed, I guess?
Agreed that use of C/++ code in general is bad and for all the effort spent on mitigation, we'd be better off moving to a proper language, but ... doesn't seem like that's happening.
A rewrite is rather silly; the NT kernel is well respected and capable. You're basically suggesting "throw away everything and start a new company" which certainly doesn't seem like a winning strategy.
I'm unaware of any time the CLR would provide any useful attack surface. The only ones that come to mind are GDI+ issues that .NET inherits via passthrough. So, citation needed, I guess?
Agreed that use of C/++ code in general is bad and for all the effort spent on mitigation, we'd be better off moving to a proper language, but ... doesn't seem like that's happening.
A rewrite is rather silly; the NT kernel is well respected and capable. You're basically suggesting "throw away everything and start a new company" which certainly doesn't seem like a winning strategy.