Re: Writing Secure Code...

David LeBlanc wrote:
> I think the most secure apps are written by the people who have the best
> developers. That's my short answer. As an illustration, consider DNS
> servers. Which is more secure, BIND, or Daniel Bernstein's DNS? They're
> both OSS, and I think we'd all agree that BIND has a terrible record,
> and DJB's has a very good record. Now consider Microsoft's DNS - it's
> also had a very good security record, with very, very few bulletins over
> the years. So which is the better predictor of security? Business model,
> or developer skill? I think it is developer skill.
> 
> One thing to add is that security isn't just developer skill. It is
> design, testing, and the processes put into place to verify whether the
> developer and designers made security mistakes or not. These practices
> are also orthogonal to business model. Having people poking at your
> software, whether it is by reading the source or by reading the binary,
> can be helpful in finding problems, but I think it is overall less
> helpful than having proper processes in place to improve security at
> every stage and phase of the development process, from design to
> implementation to testing. So the better question to ask is what
> processes are in place for a given solution to ensure security, not
> whether it is based on OSS or proprietary software.

<amen corner>
Thank you, David!  This has been one of my hot buttons for years.  I've 
finally stopped ranting about it 'cause I'm afraid I've stretched the 
tolerance of the moderators of the security lists to the breaking point. 
    People are very quick to throw darts at the coders who worked on 
insecure code, but rarely take into consideration that the reason the 
code sucks is that it was probably produced under conditions that were 
not too far removed from torture under imbecilicly impossible deadlines. 
  In other words, under processes that guarantee incomplete, buggy and 
insecure software . . .  I couldn't agree more.  It's all in the process.

My devaluing 0.02USD.

Cheers,

/g