Security

Ask something
Discussion Locked

No such things as secure software

0 helpful
5 replies

by editor's response

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Do you agree or disagree with Jon Yarden's opinion that it's impossible to write completely secure software? Let us know if this information, as featured in the April 21 Internet Security e-newsletter, is useful to you.

If you haven't subscribed to our free Internet Security e-newsletter, you're missing out on some great information. Subscribe today!

https://www.techrepublic.com/techmails.jhtml?repID=r001

5 replies

by microhell

I did not read the article, but I do have to say it would be very difficult to write 100% secure software. Main reason I believe this is because of the operating system itself. For instance, you write a secure web server on a Microsoft platform, you will have to use some of the system dll's and that is where you will have your problem. You could write from scratch, but who does that these days. Even on *nix boxes, you are still using system lib's. What I am trying to say is your program will be as secure as the systems they run on.

by hal 9000

There is never a perfectly secure Program/Operating System/Computer all we can hope to do is make the things as secure as possible from our current knolledge.

by bob

"Forever" is correct--you're never done shoring
up vulnerabilities. My general rule of thumb is
if it takes an hour to write code sufficient to
tackle the task, it will take 5 to 8 times that
to make the code moderately robust (logging, log
maintenance, error and process notification,
etc.). Remember, you want something bad? You'll
probably get it that way.

by st0rmchaser

As fast as you write the secure program, someone will be out there trying to break it. It's not just firewalls, it anti-virus programs too. There is no such thing as 100% when it comes to security, the internet is full of doer's, (those with nothing better to do) and prove'rs. (Out to prove they can do it, and "show off" and "brag" about it.) A never ending cycle. other thing is to consider the fact that some problems do not become a security issue until it is "accidentally found", or tested as a "what if I". I did not read the article, but I am sure the same thing was said.

by hand2hand

The buffer overflow argument grows old. Everyone knows, thats from bad programming practices. And an insufficient understanding of the problem at hand.
Secure Software is an erroneaous statement, it means nothing without a context. Secure where? how? when?
the old buffer overflows where never flushed out, and the Admins where not keeping up on the updates, if there where any. In otherword is it the code? which version? is there a fixe? Maybe Mgt. is the security problem.

Secure code comes from knowledge of the problem, proper metrics and sufficient test engine to genererate all the possible inputs.

This discussion is closed to new replies.