| |||||||||||||
A Tale of Two Pwnies (Part 1)A Tale of Two Pwnies (Part 1)Posted May 23, 2012 10:40 UTC (Wed) by mpr22 (subscriber, #60784)In reply to: A Tale of Two Pwnies (Part 1) by epa Parent article: A Tale of Two Pwnies (Part 1) All bugs in programs exposed to untrustworthy input are security bugs unless provable otherwise.
(Log in to post comments)
Trustworthy input? Posted May 23, 2012 12:00 UTC (Wed) by man_ls (subscriber, #15091) [Link] Your statement is harder than it looks: all input is untrustworthy unless proved otherwise.
Trustworthy input? Posted May 23, 2012 12:16 UTC (Wed) by mpr22 (subscriber, #60784) [Link] Your statement regarding the trustworthiness of input is a true and useful counterpart to my statement about bugs; thank you.
Trustworthy input? Posted May 25, 2012 10:26 UTC (Fri) by bricef (guest, #80336) [Link]
Conclusion: All bugs are security bugs unless your program takes no input.
Trustworthy input? Posted May 25, 2012 10:42 UTC (Fri) by man_ls (subscriber, #15091) [Link] A heuristic refinement of your statement would be: confine processing of user input to a specific module inside your program, and treat bugs in that module as security bugs. The remaining bugs should have lower priority (but they might also be security bugs if the input module doesn't do a good job).
|
|||||||||||||