Re: Re[2]: Penetration testing via shrinkware

["Perry E. Metzger" <perry () piermont com>]

"Marcus J. Ranum" writes:
> Richard Christie wrote:
> > What your really driving at Marcus is developing software in a trusted manne
r. 
> > Companies developing Firewall software should be evaluated by SEI for a
> > Capability Maturity Model (CMM) rating.
>
> ARrrggghhHH!!!!
>
> More formalistic nonsense scams! Does someone's ability to
> predictably generate documentation really correlate to their
> ability to produce a good product that works?? The SEI evaluation
> may have some validity, but it strikes me more like an attempt
> to do one of those ISO9000-oid certification scams.

I really very strongly agree.

> From what I can tell, no giant formalism substitutes for having people 
who know what they are doing looking over your design.

> It's important that people developing security products know
> what they're doing,

BING BING BING BING BING

> and know how to write security critical
> code -- but I can't think of a practical way to legislate it.

You can't.

Perry