bugtraq - Re: Oracle - the last word

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 11 May 2006 21:17:18 +0200
From: Stefano Di Paola <stefano.dipaola@...ec.it>
To: "Steven M. Christey" <coley@...re.org>
Cc: davidl@...software.com, bugtraq@...urityfocus.com
Subject: Re: Oracle - the last word

Il giorno mer, 10-05-2006 alle 18:28 -0400, Steven M. Christey ha
scritto:
> David Litchfield said:
> 
> >When Oracle 10g Release 1 was released you could spend a day looking
> >for bugs and find thirty. When 10g Release 2 was released I had to
> >spend two weeks looking to find the same number.
> 
> This increasing level of effort is likely happening for other major
> widely audited software products, too.  It would be a very useful data
> point if researchers could publicly quantify how much time and effort
> they needed to find the issues (note: this is not my idea, it came out
> of various other discussions.)  Level of effort might provide a more
> concrete answer to the question "how secure is software X?"

Maybe then you will have to answer to the question: "How skilled are
security researchers?" or better "how well they slept last night?".
I think software security is more measurable than human skill
(deterministic vs. chaotic systems)...

But at this point I have a some thoughts about words semantic ...maybe
there's a real inner tautology thinking that programmers are human
beings...

> Some researchers might not want to publicize this kind of information,
> but this would be one great way to help us move away from the
> primitive practice of counting the number of reported vulnerabilities.

Correct me if i'm wrong but Rfpolicy didn't say a word about this ;)

> (and while I'm talking about quantifying researcher effort, it might
> be highly illustrative to measure how much time is spent in dealing
> with vendors during disclosure.)

This could be a better point of view as David said.
And are really software certifications talking about quality?
IMHO they don't. 
Fake certification expose us to bad developed code, but maybe process
certifications (if applied) could mitigate risks.

0.002 Euro from my wallet

Stefano

> - Steve
> 
-- 

......---oOOo--------oOOo---......
Stefano Di Paola
Software Engineer
Email: stefano.dipaola_at_wisec.it
Email: stefano.dipaola1_at_tin.it
Web: www.wisec.it
..................................