Return-Path: <sentto-279987-1539-996756136-fc=all.net@returns.onelist.com> Delivered-To: fc@all.net Received: from 204.181.12.215 by localhost with POP3 (fetchmail-5.1.0) for fc@localhost (single-drop); Thu, 02 Aug 2001 05:44:09 -0700 (PDT) Received: (qmail 14241 invoked by uid 510); 2 Aug 2001 11:44:37 -0000 Received: from n17.groups.yahoo.com (216.115.96.67) by 204.181.12.215 with SMTP; 2 Aug 2001 11:44:37 -0000 X-eGroups-Return: sentto-279987-1539-996756136-fc=all.net@returns.onelist.com Received: from [10.1.4.56] by mq.egroups.com with NNFMP; 02 Aug 2001 12:42:16 -0000 X-Sender: fc@big.all.net X-Apparently-To: iwar@yahoogroups.com Received: (EGP: mail-7_2_0); 2 Aug 2001 12:42:15 -0000 Received: (qmail 91909 invoked from network); 2 Aug 2001 12:42:14 -0000 Received: from unknown (10.1.10.26) by l10.egroups.com with QMQP; 2 Aug 2001 12:42:14 -0000 Received: from unknown (HELO big.all.net) (65.0.156.78) by mta1 with SMTP; 2 Aug 2001 12:42:14 -0000 Received: (from fc@localhost) by big.all.net (8.9.3/8.7.3) id FAA03776 for iwar@yahoogroups.com; Thu, 2 Aug 2001 05:42:14 -0700 Message-Id: <200108021242.FAA03776@big.all.net> To: iwar@yahoogroups.com In-Reply-To: <9kbftg+van5@eGroups.com> from "ellisd@cs.ucsb.edu" at Aug 02, 2001 12:09:19 PM Organization: I'm not allowed to say X-Mailer: don't even ask X-Mailer: ELM [version 2.5 PL1] From: Fred Cohen <fc@all.net> Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com Delivered-To: mailing list iwar@yahoogroups.com Precedence: bulk List-Unsubscribe: <mailto:iwar-unsubscribe@yahoogroups.com> Date: Thu, 2 Aug 2001 05:42:14 -0700 (PDT) Reply-To: iwar@yahoogroups.com Subject: Re: [iwar] Re: China Skeptical Code Red PC Worm of Chinese Origin Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit [FC - This is now way off topic - but I like it anyway] Per the message sent by ellisd@cs.ucsb.edu: > > I disagree that it's harder to make systems more secure than to have to > > constantly patch them. While patches may be inevitable in computer > > systems as they are in automobiles, when you build a better system the > > qwuality leads to lasting value. The issue in computers is that the > > technology has been changing so quickly that "new" has been widely > > perceived as better than "high quality" - always a mistake when surety > > is the objective. > This is a different tangent than what I wanted to pursue... > I agree that there is better, lasting value in more reliable systems. > It is just harder to build really reliable systems than it is > unreliable systems. Sure, the formal methods community has produced > some methods that would drastically increase the reliability of > software, but it is too expensive and too hard. The testing community > has produced nothing really helpful in building more reliable systems > (regression testing is far from complete). This is one of my favorite discussions... For the vast majority of systems in day-to-day use, the design and implementation is way too complicated. You don't need software engineering teams to build a secure web server - look at the Trivial HTTP Daemon (thttpd) which I wrote in the mid 1990s and was proven to meet its security design requirements in a Ph.D. thesis a few years later. It's only 80 lines of C - and much of that is for auditing. Surety comes from simplicy and certainty of design more than anything else. I think that the main reason we have unreliable software is that it is largely bloated - for programmer convenience or pleasure. Microsoft is notorious for this, and unfortunately, recent versions of Linux have seemed to start to follow this line. It's a simple premise - a programmer should know precisely what their programs do - in detail. If they don't then the programs will not be very sure. FC --This communication is confidential to the parties it is intended to serve-- Fred Cohen Fred Cohen & Associates.........tel/fax:925-454-0171 fc@all.net The University of New Haven.....http://www.unhca.com/ http://all.net/ Sandia National Laboratories....tel:925-294-2087 ------------------------ Yahoo! Groups Sponsor ---------------------~--> Small business owners... Tell us what you think! http://us.click.yahoo.com/vO1FAB/txzCAA/ySSFAA/kgFolB/TM ---------------------------------------------------------------------~-> ------------------ http://all.net/ Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
This archive was generated by hypermail 2.1.2 : 2001-09-29 21:08:38 PDT