-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11.07.2014 17:58, Matt DeMoss wrote: > For legacy code, what about sandboxing it and then proving > something about the sandbox? Not sure if that's really in the > spirit of verification you had in mind. Well if your sandbox would be proven to be secure there is still the problem: How does the legacy code behave inside the sandbox? Is it acceptable that it maybe just breaks when the sandbox refuses to do $x ? So to my understanding you must not just prove the sandbox itself, rather show that the interaction between sandbox and legacy code are "ok".
Without going into details or a specific example I still got the feeling this could be more complex than just proving the legacy code/rewrite that code. kind regards Sven -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQGcBAEBAgAGBQJTwBicAAoJEAq0kGAWDrqlZwQL/iJGOnNFbtJ3CJ+oimWoXdD4 +02h1Egsjtd+hDsIxmDoS2OdnrEYjTGN3imcjlkn1xmasgS0V0GJ8dpCLL+5+mgT l2+RdHe8A+7cq7gm9U0puifgQnTFoXOMQY9hcFvFXsQpf6tFgK3QYJiNwqwNJ2VZ yAO5x/3BECB4mR73ykqC67sexKJZK0LhoFWouT2a8zakA96JwI5YpyV3zI6C+/gt fXRg976zG95DQS4xN8oNbCwc+kFcTbN4WHqdIL6cTj59NufYKVA5AzlkJReZ/oHM bmkkSXk7J12bJU3ivE9y4QREkEDLERObh+bK0bcMwXnyy5/qceVoNjJ+uhvQIkCY FrmHgYCrq7lQX8xu969yyioRvzAX8nSjhkQzeyvaKzmEZlGgOmiSCYrWqQDEgGu2 ZINnooNPeajlTiuMCNM9ru0JxhifGIUtBp2jrNdecsQk4GR09muazrGf943+/LeD kBYN/0KBJ4V1+6XWwZ2/ZqIS120ftqyB4bvrJaLTug== =Lgja -----END PGP SIGNATURE----- _______________________________________________ langsec-discuss mailing list langsec-discuss@mail.langsec.org https://mail.langsec.org/cgi-bin/mailman/listinfo/langsec-discuss
