Secure Coding mailing list archives

Bugs and flaws


From: al.eridani at gmail.com (Al Eridani)
Date: Fri, 3 Feb 2006 08:20:56 -0800

On 2/2/06, David Crocker <dcrocker at eschertech.com> wrote:
If some small bolt in my car fails because the bolt met its manufacturer's
specification but was not strong enough to withstand the loads it was subjected
to, that is a low-level design error, not a manufacturing error.

I agree.

Similarly, I view coding errors as low-level design errors.

I disagree.

If the design says "For each fund that the user owns, do X" and my
code does X for
all the funds but it skips the most recently acquired fund, I see it as a
"manufacturing" error.

On the other hand, if a user sells all of her funds and the design
does not properly
contemplate the situation where no funds are owned and therefore the software
misbehaves, I see it as a "design" error.




Current thread: