Re: Thoughts on Shellshock and beyond

["David A. Wheeler" <dwheeler () dwheeler com>]

> * Heartbleed is an out of bounds memory read. Well understood and yes,
  it should be possible to implement mitigations against these kinds of
  things.

It is not only possible, I have already posted a list of ways to find Heartbleed:
http://www.dwheeler.com/essays/heartbleed.html

I think identifying specific ways to counter classes of vulnerabilities is really important.

> What class of bug is Shellshock? "Weird feature invented in
  pre-Internet era"? How do you conquer this class of bugs?

I am still struggling with this one.  I am trying to create that list here:
http://www.dwheeler.com/essays/shellshock.html#detect-or-prevent

But to be honest, that list is pretty pathetic. This is a challenging class of vulnerability to detect or prevent ahead 
of time. Ideas would be very welcome.

--- David A.Wheeler