RE: Secure Coding? Bah!

["Robert Paris" <rpjava () hotmail com>]

The article is wrong, yet also right. It's right that most people don't care 
and companies couldn't care less about the security of the products they 
sell (not the ones they use). It's also right in that the programmers of 
software cannot (and largely should not) be bothered to write top security 
in to their programs. If they did try to do that a few things would happen:

1. It's take a lot of their time away from writing a well stuctured program
2. They'd inevitably not understand the security implications of each 
decision they made and it would end up being poor security (with likely 
other problems)
  They don't understand security well enough.

HOWEVER, the answer? We need better frameworks/languages that incorporate 
EASY TO USE/IMPLEMENT security architectures. For example, who here writes 
in Java? Have you ever tried to write a program that actually uses security 
checks in it? I mean at the Java code level, not user name password, cert 
stuff. It's a pain in the butt, and a very poorly thought out system. The 
worst thing is when I need to use third party software and MY needs for 
security are different than from how they structured security in their 
program. How do I implement it so that no one can add in new code that 
doesn't follow my security ideas? With Java's current security mechanism I 
CANNOT add security/permission checks to the third party software! And 
frankly, adding it to mine is a bit of a pain too. It should be easy, and 
not involve a lot of programming on my part. It should be: plug it in and 
then in an administrative fashion, add on the security. EJBs get a little 
closer to this, and that's a start.

The point is simply that the reason security is such a problem is that it's 
NOT EASY. That's it. And the people to make it easy are the ones building 
languages (like Java), framework APIs - not the ones building programs. By 
that point it's too late.

_________________________________________________________________
Check out the new MSN 9 Dial-up — fast & reliable Internet access with prime 
features! http://join.msn.com/?pgmarket=en-us&page=dialup/home&ST=1