oss-sec mailing list archives
Re: Thoughts on Shellshock and beyond
From: Pavel Labushev <pavel.labushev () runbox no>
Date: Fri, 10 Oct 2014 04:56:37 +0800
On Thu, 09 Oct 2014 15:00:04 -0400 (EDT) "David A. Wheeler" <dwheeler () dwheeler com> wrote:
On Thu, 9 Oct 2014 10:34:49 -0700, Tracy Reed <treed () ultraviolet org> wrote:Sure, but at least with Haskell (and the like) you have to make it very explicit that this is what you want to do.Not in this case. A Haskell implementation of the POSIX "sh" specification, that then added function imports, could have made the same mistake just as easily.
Just as easily? Might be, but that's a totally unjustified conclusion. First of all, *if* a programmer wants to express higher level concepts (such as "untrusted data" and how it may and may not be manipulated) in languages like Haskell, he doesn't resort to some sort of manual labour of maintaining a masochistic discipline of performing tedious repetitive tasks in the context of ubiquitous uncertainty and fuzzy reasoning, no. He expresses himself in a much more concise and abstract way, and places much of the burden of reasoning and proving on the machine. Complexity must be under control, reasoning must be automated as much as practically possible. While you seem to suggest continue to make the same critical methodological mistake that the industry keeps making over and over and over again since Von Neuman. The burden - machines must carry it, not humans. We don't *want* to carry it, isn't it clear already? And in the light of that fact, it doesn't really matter whether we can or can not. Then, let's assume that Haskell or some other technology is indeed a crucial part of a solution (there's probably not the only one). Obviously, some people don't want to "learn Haskell". And some of them don't even want to "participate in this security circus" at all. So, it's a personal choice of each and every one of us: do we want to become a part of a solution or we are ok with remaining a part of the problem. And making this choice either way is so much easier and more productive than trying to find universal solutions for everyone.
But let's not oversell the tools.
I'd say let's start considering the emergent properties of the systems that the tools and their users are parts of. Otherwise we would certainly throw the baby out with the water, instead of overselling anything.
Educating developers is less risky, way faster, and costs less too.
Educating to do what exactly? Like writing secure code in C? It doesn't work much more often than not, and absolutely doesn't scale. And why do you think it's less risky and even *way* faster (faster than what? faster in general?)? People don't learn in vacuum, they need and happen to have real life experience, which means writing real life code, in real life circumstances: changing requirements, increasing complexity, limited time and cognitive resources, many different conventions to follow, questionable quality standards (hello, time to market and lean development), aggressive social context and unstable motivation. Who do you expect will pay the expenses? An employer, an employee, an independent open source contributor, the users or customers? Barely and rarely, to put it mildly.
Attachment:
_bin
Description:
Current thread:
- Re: Thoughts on Shellshock and beyond, (continued)
- Re: Thoughts on Shellshock and beyond Stephane Chazelas (Oct 08)
- Re: Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 08)
- Re: Thoughts on Shellshock and beyond Tim (Oct 08)
- Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 08)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 08)
- Re: Thoughts on Shellshock and beyond Tracy Reed (Oct 08)
- Re: Thoughts on Shellshock and beyond Tim (Oct 08)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 08)
- Re: Thoughts on Shellshock and beyond Tracy Reed (Oct 09)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 09)
- Re: Thoughts on Shellshock and beyond Pavel Labushev (Oct 09)
- Message not available
- Re: Thoughts on Shellshock and beyond Florian Weimer (Oct 10)
- Re: Thoughts on Shellshock and beyond Pavel Labushev (Oct 11)
- Message not available
- Re: Thoughts on Shellshock and beyond Florian Weimer (Oct 12)
- Re: Thoughts on Shellshock and beyond John Haxby (Oct 12)
- Re: Thoughts on Shellshock and beyond Pavel Labushev (Oct 14)
- Re: Thoughts on Shellshock and beyond Sven Kieske (Oct 09)
- Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 09)
- Re: Thoughts on Shellshock and beyond Sven Kieske (Oct 09)
- liability (was: Re: Thoughts on Shellshock and beyond) Solar Designer (Oct 09)
- Re: liability dmc (Oct 09)