RE: The Morris worm to Nimda, how little we've learned or gained

[Ryan Russell <ryan () securityfocus com>]

<snip really good highway safety discussion by Robert Graham>

One point that always comes to my mind when reading any analogy for
Internet Security is that perfect security is theoretically possible on
the Internet.  (Discounting availability...you'll always be able to DoS
me.)  In theory, I could implement a service with no holes, no way to
attack it remotely, on top of an OS with no holes.  You'd never be able to
make my machine do something I didn't want it to.  Conversly, it is
theoretically impossible to have a car that will prevent someone from
violating the integrity of your body.  There are always tac nukes, if
simple ramming won't suffice.

While theoretically possible to have perfect software security, it is
obviously a practical impossibility.

I have no idea if that means that we should try harder, and come as close
as possible to perfection, or just give up now.  There are a few software
packages out there that do really well on security, and I think it's that
tease that keeps us going.  At present, my mode is "try harder".

                                        Ryan

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://list.nfr.com/mailman/listinfo/firewall-wizards