[SC-L] Containing bad code

2012-05-13 Thread Ben Laurie
Given the recent discussion, I thought the list might be interested in: http://www.links.org/?p=1242. I'm currently working on transparently wrapping libtiff (that is, wrapping it such that the calling application is unaware it is wrapped). Using Capsicum For Sandboxing

Re: [SC-L] SearchSecurity: Badware versus malware

2012-05-12 Thread Ben Laurie
1:51 PM, Ben Laurie b...@google.com wrote: On 8 May 2012 07:18, Gary McGraw g...@cigital.com wrote: hi sc-l, What¹s worse, bad software or malicious software?  In fact, what¹s the difference? My second column for SearchSecurity is all about that.  Read it today. And pass it on. http

Re: [SC-L] Microsoft SDL report card

2011-05-03 Thread Ben Laurie
On 18 April 2011 18:46, Andy Steingruebl stein...@gmail.com wrote: On Fri, Apr 15, 2011 at 7:33 AM, Ben Laurie b...@google.com wrote: Which is why I am interested in and devoting most of my time now to capability systems. Ben, Is your work focused on the technical bits

Re: [SC-L] Microsoft SDL report card

2011-04-05 Thread Ben Laurie
=1636983 (September 23, 2010) You might also listen to Langner on Silver Bullet (the longest episode ever, but a good one): http://www.cigital.com/silverbullet/show-059/ gem On 4/1/11 9:16 AM, Ben Laurie b...@google.com wrote: On 31 March 2011 13:03, Gary McGraw g...@cigital.com wrote: hi sc

Re: [SC-L] InformIT: comparing static analysis tools

2011-02-04 Thread Ben Laurie
On 3 February 2011 16:02, Jim Manico jim.man...@owasp.org wrote: Chris, I've tried to leverage Veracode in recent engagements. Here is how the conversation went: Jim: Boss, can I upload all of your code to this cool SaaS service for analysis? Client: Uh no, and next time you ask, I'm