On 6/18/13 12:09 PM, Roger Critchlow wrote:
You talk as if there were someone, somewhere, who has an adequate
grasp of all the details.
Exactly. Individuals and all kinds of organizations have come to expect
promiscuity without consequence when it comes to the use of software.
As more and more critical system software is written overseas, or by
foreign nationals in the U.S., it is stupid to think that these
individuals, organizations, and/or governments aren't fully capable of
planting malware in trusted tools and services. Even assuming that
engineered malicious software could be reliably identified and
quarantined from executable content (it can't), there's an ever
increasing body of spongy, bug-ridden software just waiting for
motivated people to exploit for unfriendly purposes.
For applications that matter, my view is that the whole software stack
must be made available for inspection as source code, and a community of
expertise and criticism must be built around it.
This not to say that there will be someone that gains the`adequate'
grasp. But, with all this in hand the organization can at least see
the scope of their potential risk. For anything non-trivial the risk
will be large. Those that claim to care about security above all else
must begin to realize the extent of what they don't know, and carefully
build up systems from components that are, as much as is possible,
transparent and tested -- or proven -- to work in all possible
situations and refuse to work outside of that domain.
Marcus
============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com
