看板FB_security
标 题Re: De Raadt + FBSD + OpenSSH + hole?
发信站NCTU CS FreeBSD Server (Mon Apr 21 22:49:45 2014)
转信站ptt!csnews.cs.nctu!news.cednctu!FreeBSD.cs.nctu!.POSTED!freebsd.org!ow
In message <
[email protected]>,
Christian Kratzer <
[email protected]> wrote:
>On Mon, 21 Apr 2014, Ronald F. Guilmette wrote:
>>
>> In message <
[email protected]>,
>> "hcoin" <
[email protected]> wrote:
>>
>>> ... It is for the community to decide whether it is 'worth it'
>>> on a case by case basis given there is no way to prove a program
>>> 'correct' from a security perspective.
>>
>> I guess that I was sick that day in software school.
>>
>> Did I just hear you tell me that I can't prove the following program
>> is "secure"?
>>
>>
>> int
>> main (void)
>> {
>> return 0;
>> }
>
>in an ideal world you could propably. The difficulty ist that even
>above seemingly trival snippet of code is run after initialization of
>the c runtime library and some pre processing of argc, argv.
>
>It gets more complex with c++ contstructors run before main.
>
>If gets even more complex the more software components interact in
>wierd and wonderfull ways.
At the risk of stating the obvious...
Complexity != Impossibility
I think that we need better tools.
But then again, I have always thought that, and undoubtedly always will.
Regards,
rfg
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "
[email protected]"