full-disclosure - automated vulnerability testing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: automated vulnerability testing 

On Sat, 29 Nov 2003 15:11:02 EST, Bill Royds <full-disclosure@...ds.net>  said:
> Only a good programmer can write safe C.
> Most programmers are not good programmers.
> Therefore  most C code is not safe and should not be trusted.

Flon's Law: There is not now, and never will be, a language in which it is the
least bit difficult to write bad programs.

Let's think this through. You don't want them using C because they can't
program their way out of a paper bag - they can't even get simple concepts
like "Check the length of a string before using it" down.  But you want them
to use languages that still permit more *subtle* errors?

How many postings do we see about bad C code on this list?  Many of which
are so esoteric that we're still arguing months later whether it's actually
exploitable?  And how many postings do we see about PHP code with XSS issues?

And I'll point out that Liu Die Yu dropped us 7 very nice bugs in IE which
all appeared to be of the "logic error" type that would have *still*
happened, no matter what the language, as the failure was in the algorithm
encoded rather than the implementation.  Let's look at one of his
descriptions:

"When CONTENTTYPE in HTTP response is invalid and file extension is "HTM", the
downloaded HTM file will be opened in cache directory, in INTERNET security
zone."

It's painfully obvious what went wrong.  And no choice of programming language
would have protected against the "think-o" that caused this bug.

Yes, the current state of programming is abysmal.  But the *real* problem here
is that we're letting programmers who can't even handle simple things be in
charge of very complicated projects - and that should give you some very
not-warm-and-not-fuzzy feelings....

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031130/1c369e2c/attachment.bin