Secure Coding mailing list archives
bumper sticker slogan for secure software
From: pmeunier at cerias.purdue.edu (Pascal Meunier)
Date: Thu, 20 Jul 2006 13:36:52 -0400
On 7/20/06 11:58 AM, "Florian Weimer" <fw at deneb.enyo.de> wrote:
* der Mouse:Absolute security is a myth. As is designing absolutely secure software.I have high hopes in formal methods.All formal methods do is push bugs around. Basically, you end up writing in a higher-level language (the spec you are formally verifying the program meets). You are then subject to the bugs present in *that* "program" (the spec) and the bugs present in the "compiler" (the formal verifier).But people are forced to spend more time with the code, which generally helps them (in particular smart people) to eradicate bugs. Another way to achieve the same thing is to freeze the code base and let it mature over decades, but I don't see the business model for that.
Also, writing it twice with different languages, especially at different levels of abstraction, makes it less likely that the same bugs will appear in both. You can choose the higher level language so that it has great expressive power exactly for the things that are a pain to capture and verify (and thus a source of bugs) in the lower-level language. Last time I checked, formal methods were even able to catch design errors in some networking protocols. But you're right, they are not absolutely perfect because the tools and operators aren't, etc... That doesn't mean they can't help a great deal. I have great hopes for their usefulness. Maybe some day they will help so much that the distinction between what they can produce and absolutely secure software will become too small to matter. Whether we'll still be alive when that happens is another question. Pascal
Current thread:
- bumper sticker slogan for secure software, (continued)
- bumper sticker slogan for secure software Dana Epp (Jul 18)
- bumper sticker slogan for secure software Andrew van der Stock (Jul 18)
- bumper sticker slogan for secure software Wietse Venema (Jul 18)
- bumper sticker slogan for secure software mikeiscool (Jul 18)
- bumper sticker slogan for secure software Andrew van der Stock (Jul 19)
- bumper sticker slogan for secure software mikeiscool (Jul 19)
- code review tools for tcl? j eric townsend (Jul 20)
- bumper sticker slogan for secure software Dana Epp (Jul 18)
- bumper sticker slogan for secure software Pascal Meunier (Jul 19)
- bumper sticker slogan for secure software der Mouse (Jul 19)
- bumper sticker slogan for secure software Florian Weimer (Jul 20)
- bumper sticker slogan for secure software Pascal Meunier (Jul 20)
- bumper sticker slogan for secure software Florian Weimer (Jul 20)
- bumper sticker slogan for secure software Pascal Meunier (Jul 20)
- bumper sticker slogan for secure software ljknews (Jul 20)
- bumper sticker slogan for secure software Blue Boar (Jul 20)
- bumper sticker slogan for secure software der Mouse (Jul 20)
- bumper sticker slogan for secure software Pascal Meunier (Jul 20)