[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <dbb07692-6f92-48d1-ac35-239943831edd@wichmann.us>
Date: Sat, 27 Sep 2025 18:32:04 -0600
From: Mats Wichmann <mats@...hmann.us>
To: oss-security@...ts.openwall.com
Subject: Re: How to do secure coding and create secure software
On 9/27/25 02:30, Amit wrote:
> -----------------------------------------------------------------------
> How to do secure coding and create secure software
> -----------------------------------------------------------------------
>
> I can do secure coding and no one can hack my code unless the language/OS have
> some issues. You can challenge me on this.
>
> Ultimately, all software boil down to functions/methods. If functions/methods
> are secure then the whole software is secure.
That's just plain silly. You will get challenged on this... already
seen some. I'll just post a hokey analogy: a door lock is secure, as it
requires a "thing you have" (the key). The API is fine. If you don't
protect the security token (leave the key under a flowerpot), that's not
the fault of the lock - defeated by bad security processes and no fault
of the "function". If someone kick in the door it's bad design: a door
jamb made out of wood isn't safe from a brute force attack, even if the
lock mechanism itself wasn't breached.
The "whole system" matters a lot. Secure functions are necessary but not
sufficient.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
