Re: Re[2]: Penetration testing via shrinkware

[Matthew_S_Cramer () armstrong com]

mjr () nfr net wrote:


> It's important that people developing security products know
> what they're doing, and know how to write security critical
> code -- but I can't think of a practical way to legislate it.


I don't see anything ever being more practical than open source and peer review.
There is nothing else that comes close in terms of effiency and redundancy.
People may *try* to legislate security, but that just offers vaporware penalties
and benefits ("I'm scam-org certified, and he's not!") which still requires some
other way of proving or disproving whether or not the certification is valid.

Certain types of review could be automated with software (say, cheking for
certain types of buffer overflows in c code), but then *that* piece of software
would have to be trusted.  It is a ctach-22.



Matt