bumper sticker slogan for secure software

[michaelslists at gmail.com (mikeiscool)]

> Sorry, but it is a fact. Yes, you can have provably correct code. Cost
> is approximately $20,000 per line of code. That is what the "procedures"
> required for correct code cost. Oh, and they are kind of super-linear,
> so one program of 200 lines costs more than 2 programs of 100 lines.

Someone already pointed this out but your numbers here have no basis.
Provide references or something, otherwise they are meaningless.


> > This isn't as true and as wide spread as you make it sound. Consider,
> > for example, "SQL Injection". Assuming I do not upgrade my database,
> > and do not change my code and server (i.e. do not change my
> > environment at all), then if I have prevented this attack initially
> > nothing new will come up to suddenly make it work.
>
> Indeed, consider SQL injection attacks. They didn't exist 5 years ago,

Prove it.


> because no one had thought of them. Same with XSS bugs.

Again prove it.

I might say that they didn't exist at a given time because apps that
were affected weren't widely deployed. Online BBS's are relatively
new, and that, to my memory, was the first place for XSS bugs.


> What Dana is trying to tell you is that some time in the next year or
> so, someone is going to discover yet another of these major
> vulnerability classes that no one has thought of before. At that point,
> a lot of code that was thought to be reasonably secure suddenly is
> vulnerable.

Right, but if your environment is unchanged and you've looked at all
angles, then you will not be affected. Note that I'm not saying it's
easy, but ..


> > Not true; you can call other libraries happily and with confidence if
> > you handle the case of them going all kinds of wrong.
>
> This also is false. Consider the JPG bug that badly 0wned Microsoft
> desktops a while back. It was a bug in an image processing library. You
> try to view an image by processing it with the library, and the result
> is that the attacker can execute arbitrary code in your process. That is
> pretty difficult to defensively program against.

Why?


> Crispin

-- mic