[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <544cce0b-2734-47cd-9037-dc29a6ed0f73@apache.org>
Date: Sat, 27 Sep 2025 16:57:15 -0700
From: Michael Jumper <mjumper@...che.org>
To: oss-security@...ts.openwall.com
Subject: Re: How to do secure coding and create secure software
On 9/27/25 1:30 AM, Amit wrote:
> -----------------------------------------------------------------------
> How to do secure coding and create secure software
> -----------------------------------------------------------------------
>
> I can do secure coding and no one can hack my code unless the language/OS have
> some issues. You can challenge me on this.
>
> Ultimately, all software boil down to functions/methods. If functions/methods
> are secure then the whole software is secure.
>
Unfortunately, this is simply a faulty premise. You need to consider the
security of what you've built separately from the security of your
building materials.
Security of software isn't inherited from the isolated security of each
of its functions, and it is generally not valid logic to assume that a
particular quality of the components of a whole will extend to the
entire whole:
https://en.wikipedia.org/wiki/Fallacy_of_composition
Consider individual CPU instructions as an easy counter example. Every
function is made up of such low-level instructions, and these
instructions are functions in their own right. The original core premise
would imply that no software vulnerabilities can exist except where
individual CPU instructions are vulnerable, which is clearly not the case.
When you build something out of lower-level components, focusing purely
on the security of those components ignores the *arrangement* of those
components. From arrangement ("I'm made up of atoms"), higher levels of
behavior emerge ("I'm writing this email"), and you're left with
something that has its own security model that must be freshly considered.
- Mike
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
