Re: Thoughts on Shellshock and beyond

["David A. Wheeler" <dwheeler () dwheeler com>]

On Wed, 8 Oct 2014 21:31:37 -0700, Michal Zalewski <lcamtuf () coredump cx> wrote:
> Sure, agreed. I don't think the code / data catchphrase accurately
> conveys this principle to developers, though =)

I've expanded the detection or prevention section of my paper in general:
  http://www.dwheeler.com/essays/shellshock.html#detect-or-prevent

In particular, I've given more information on separating code/data here,
in a way that I hope captures the point for developers:
 http://www.dwheeler.com/essays/shellshock.html#separate-code-data

--- David A. Wheeler