Miles Fidelman said on Tue, 27 Jul 2021 09:59:49 -0400

>>>> Andreas Messer said on Mon, 26 Jul 2021 09:38:23 +0200
>>>>
>>>>
>>>>> My feeling is, that you can not simply teach someone how to write
>>>>> safe software.
>>>> Why not? You can teach a person to do anything else. But maybe not
>>>> in college, because college is built to make money, not to teach.
>>>> Consider the average textbook and compare to the average "For
>>>> Dummies" book. The former makes the subject matter look incredibly
>>>> complex, justifying the professor. The latter makes it easy to
>>>> learn.
>>>>
>>>> What is needed is a curated document explaining the five or ten or
>>>> twenty things you need to do to be secure, and then how to achieve
>>>> them in a practical world. Let's start with input field cleansing
>>>> and protection from errant pointers and buffer overflow. There are
>>>> many more:

>Because there will always be new failure modes & vulnerabilities - it
>comes with any complex engineering activity.
>
>You can teach people to avoid KNOWN failure modes & vulnerabilities,
>and establish processes and methods to avoid them (e.g., tooling,
>testing, design reviews, etc.) - but there will always be new ones -
>that can only be detected in the breach. 

Exactly! The preceding list can't address 100% of exploits. The only
thing it can do is address the 90% (my guesstimate) of exploits,
leaving the remaining 10% to require ultra-intelligent badguys and rule
out the army of script-kiddies roaming the net.

As an analogy, if there were a technique to prevent 90% of car crashes,
you'd make that move and then figure out how to reduce the remaining
10%.

> Good engineers can, perhaps,
>see and avoid some.  Penetration testing can help find others before
>fielding. But ultimately, there will always be unsafe code in the
>field - that will only be detected in the breach.

Your preceding paragraph is true without a doubt. The best we can hope
for is to make it trivial for every amateur and beginning professional
coder to learn how to prevent the majority of exploits.


SteveT

Steve Litt
Spring 2021 featured book: Troubleshooting Techniques of the Successful
Technologist http://www.troubleshooters.com/techniques