Functional Correctness

[gem at cigital.com (Gary McGraw)]

hi sc-l,

There are many important security researchers who have given up on proving things about software as non-practical.  
Among them: Ross Anderson, Virgil Gligor, Bob Blakely, and Fred Schneider.   All four of those guys have been past 
silver bullet victims, and each time we discussed the antiquated notion of formal approaches to software development.

Software security is an intensely practical problem that will require a practical approach.  By studying organizations 
that are doing a decent job, perhaps we can draw some practical lessons.  That's precisely what we're up to with the 
BSIMM <http://bsi-mm.com>.

gem

http://www.cigital.com/~gem

On 8/21/09 11:54 AM, "Brad Andrews" <andrews at rbacomm.com> wrote:



I completely agree, though how are we really going to reach this
point?  We have been talking about this at least since I got into
development in the early 1980s.  We are not anywhere closer, though we
have lots of neat tools that do lots of neat stuff.  Unfortunately,
our programs are also a lot more complicated, making the "correct"
proof much more difficult.

Can we really believe it is "just around the corner" to prove this?

--

Brad Andrews
RBA Communications
CISM, CSSLP, SANS/GIAC GSEC, GCFW, GCIH, GPCI


Quoting "Cassidy, Colin (GE Infra, Energy)" <colin.cassidy at ge.com>:

> Martin Gilje Jaatun wrote:
>
> > Karen, Matt & all,
> >
> > Goertzel, Karen [USA] wrote:
> > > I'm more devious. I think what needs to happen is that we
> > need to redefine what we mean by "functionally correct" or
> > "quality" code.
_______________________________________________
Secure Coding mailing list (SC-L) SC-L at securecoding.org
List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l
List charter available at - http://www.securecoding.org/list/charter.php
SC-L is hosted and moderated by KRvW Associates, LLC (http://www.KRvW.com)
as a free, non-commercial service to the software security community.
_______________________________________________