Re: Curious questions...

[Nick FitzGerald <nick () virus-l demon co uk>]

Kowsik Guruswamy wrote:

<<snip>>
> What I'm really leading to is, how can we, as people involved in the
> security industry, address and fix this gap? Full-disclosure is fine
> and dandy, but it doesn't get to the root cause early enough.

Addressing that issue is the primary focus of the "Secure Coding" 
mailing list:

   http://www.securecoding.org/list/

Pretty low-volume and tends to be (quasi-)academics and hardened secure 
code developers talking about what has worked and where (in short, you 
get different results depending on the focus of the systems under 
development; compare and contrast systems with phenomenally high 
failure costs (life-support, aeronautics flight control and navigation, 
etc where you tend to get highly resilianet, fail-safe and expensive) 
solutions with "its good enough for a Windows user"...).

There is also talk of tools, programming language and development 
paradigm issues as they relate to better (and worse) security results.

The archives are publicly available (I think) so you can get a taste of 
what has been discussed.  Been pretty quiet the last few months...

...

Now, as this is _fun_sec and that was pretty boring:

> ps: I used to be at Juniper and I was the chief architect for their
> IDP product line. In that role, I've seen on both sides of the coin
> (more product development than active vulnerability research though).

So its _you_ we should string up??    8-)


Regards,

Nick FitzGerald

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.