Jonathan Leffler wrote:
> Under the subject "InternetNews Realtime IT News - Merchants Cope With PCI
> Compliance", Kenneth Van Wyk <[EMAIL PROTECTED]> wrote:
> [...] In talking with my customers over the past several months, I always
> find it interesting that the vast majority would sooner have root canal
> than submit their source code to anyone for external review. [...]
>
> There's a simple reason for that reluctance - most people are painfully
> aware that their software won't stand the scrutiny that an external review
> would entail.
>
>
>
>
> ___
> Secure Coding mailing list (SC-L) SC-L@securecoding.org
> List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l
> List charter available at - http://www.securecoding.org/list/charter.php
> SC-L is hosted and moderated by KRvW Associates, LLC (http://www.KRvW.com)
> as a free, non-commercial service to the software security community.
> ___
>
There is another reason I have seen quite often: you can't readily ask
the designer of
the code what it does when he is dead, or when he has left the company
(esp. if he works for a competitor). In many such situations I see code
that gets touched at all with
great fear and trembling, because people are not certain they can build
it all from
sources. Eventually that gets replaced, but in some cases that may be
long delayed.
I've used a few tools to analyze code, and noticed that mostly they
don't really know
how trustworthy external information is (or even, for sure, what is
external). Result is
much hand winnowing needed. Still they seem to take less looking than
learning
an entire code base.
I still favor trying to characterize what functions are supposed to be
invoked by
calls to routines and trying to characterize this for each
callgiving rise to
a hopefully small number of permitted patterns for any call location.
Obviously
this is much easier to do for interpreters like SQL than HTML, but the
approach
may do better against future attacks than other approaches.
Glenn Everhart
___
Secure Coding mailing list (SC-L) SC-L@securecoding.org
List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l
List charter available at - http://www.securecoding.org/list/charter.php
SC-L is hosted and moderated by KRvW Associates, LLC (http://www.KRvW.com)
as a free, non-commercial service to the software security community.
___
