Re: Another opinion on using extreme programming for security

Kenneth Buchanan wrote:
>> [Security] should not be expected as a freebie, no matter what the
>> development methodology.
> 
> I disagree with that to a certain extent.  Security is a subset of
> reliability, and should be thought of in the same way.  Just as a
> customer by default expects reliable software, customers should be
> able to expect reasonably secure software, for a certain narrow
> definition of secure.

I disagree.   Perfect (Software) Security may be a subset of perfect 
reliability, but in practice neither will be perfect.  And since you can 
only focus your efforts on a subset of the existing bugs, the choice 
between security bugs and reliability bugs will usually lead to 
different bugs being found.  As such, in practice, security is not a 
subset of a reliability except at the limit.

I agree that customers should be able to expect reasonably security 
software, and I thing that this is what is pushing MS toward their 
recent security initiative.

   Rick