Re:Hospitals across England hit by large-scale cyber-attack
by throwaway91111 on Friday May 12, 2017 @06:47PM
(#14328558)
> A method to reliably produce vulnerability-free software is not invented yet
That's not the goal. Well it is, but it's unachievable. We need to get people to care about security beyond ensuring that teenagers can't trivially get in—the current state of affairs for enterprise IT.
A law would at least require companies to give a fuck beyond the "can the CEO's niece break in" level.
Re:Hospitals across England hit by large-scale cyber-attack
by DanWaterworth on Friday May 12, 2017 @04:14PM
(#14327495)
> A method to reliably produce vulnerability-free software is not invented yet.
I beg to differ. We have formal methods, ranging from type systems to full blown verification. This isn't a technical problem, it's an economic one.
Re:Hospitals across England hit by large-scale cyber-attack
by ComodoHacker on Friday May 12, 2017 @04:23PM
(#14327571)
Had these methods been applied to security aspect of software development? Any examples?
Re:Hospitals across England hit by large-scale cyber-attack
by DanWaterworth on Friday May 12, 2017 @04:28PM
(#14327622)
On the lower end of the spectrum, sound type systems prevent a class of vulnerabilities including buffer overflows. On the upper end, https://sel4.systems/, a formally verified microkernel, is used in security-critical systems.
No, it would make IT security about as expensive as good lawyers. Just to cover the losses. A method to reliably produce vulnerability-free software is not invented yet.