Darkreading: Secure Coding Certification

[fw at deneb.enyo.de (Florian Weimer)]

* Johan Peeters:

> I agree that multiple choice alone is inadequate to test the true
> breadth and depth of someone's security knowledge. Having contributed
> a few questions to the SANS pool, I take issue with Gary's article
> when it implies that you can pass the GSSP test while clueless.

But I guess you can fail it because your views are too refined (and
you take too long to make your choices).  After all, there are
different schools of thought when it comes to secure coding and its
methodologies.  For instance, summing up buffer overflows or directory
traversals under "input validation" is somewhat debatable.