Trustworthy Computing’s Impact a Decade On: Looking Back, Looking Ahead

Re: Trustworthy Computing’s Impact a Decade On: Looking Back, Looking Ahead

Wow, I did a double-take when I read this last sentence!

Two things come to mind.

First, many years ago, one of my friends who was a great influence on my thinking in security retired as a programmer. It was customary in his times, he explained, to check and recheck each line of code for any bugs. Self-respecting programmers would be embarrassed -- if a buffer overflow today--, for example, showed up in their code.

The current problem (many vulnerabilities showing up) from his perspective was not bad programmers, rather, the urgency to release products on the market before the competition did, or to meet marketing goals (release by Christmas, etc.)

Second, in fairness, code has become so complex (especially code in an Operating System) that testing for vulnerabilities is a real problem.

Microsoft addressed this shortly after the Conficker worm which exploited MS08-067:

MS08-067 and the SDL
http://blogs.msdn.com/b/sdl/archive/2008/10/22/ms08-067.aspx

----
rich

 

Re: Trustworthy Computing’s Impact a Decade On: Looking Back, Looking Ahead

And how different from my friend's world!

The TWC initiative has been effective, but it's up against a lot of boulders in the road as it proceeds. One huge impediment is the huge number of brilliant cybercriminal programmers worldwide poring over the same lines of code, looking for potential bugs/vulnerabilities in almost every software product in the market!


----
rich

 

Ah! Living the dream...confabulation

 

Re: Trustworthy Computing’s Impact a Decade On: Looking Back, Looking Ahead

What's the difference?!


----
rich

 

Re: Trustworthy Computing’s Impact a Decade On: Looking Back, Looking Ahead

Thanks, I'll make a note of that!


----
rich