News for hackers. Stuff that matters.

A comment on The Six Dumbest Ideas in Computer Security.

Re:The Six Dumbest Ideas in Computer Security by Semiapies on Thursday March 19, 2009 @12:59PM (#523608)
I don't see much value in this essay. What makes sense is rather old hat, and points like #3 are downright absurd, boiling down to, "You can't make a system more secure by finding weaknesses and correcting them - you must make the system magically devoid of weaknesses to begin with."

Somehow, if there was much of a way of doing that with non-trivial programs, I don't think we'd have security exploits anymore.

[ Parent | on HN ]
Re:The Six Dumbest Ideas in Computer Security by niv on Thursday March 19, 2009 @05:03PM (#523993)
But the author mentioned qmail, which is an application that was built "secure by design", is non-trivial, and hasn't had many bugs. This is a little paper by the author of qmail: http://cr.yp.to/qmail/qmailsec-20071101.pdf
[ Parent | on HN ]
Re:The Six Dumbest Ideas in Computer Security by Semiapies on Friday March 20, 2009 @02:16PM (#525332)
And yet there are still qmail exploits and fixes to those.

Not many people build insecure by design, but the simple truth is that security is both hard and always surmountable in some way.

[ Parent | on HN ]