| |||||||||||
Look at OpenBSDLook at OpenBSDPosted Feb 5, 2004 17:30 UTC (Thu) by thoffman (subscriber, #3063)In reply to: Look at OpenBSD by ncm Parent article: Needed: code auditors It should be possible (and educational) to figure out how they do it just by looking at how their CVS tree has evolved over time. And reading their mailing lists, of course. But even if they discuss security issues on closed lists, the code is open and someone who took the time could look at all the patches they make, classify them into bug fixes and features, and then look at all the bug fixes and start creating a "taxonomy" of bug fixes. A well documented collection like that would be a very useful tool to teach other developers to audit code. Maybe some university prof out there will have her students put together documentation like that, and then audit some Linux code for the same sorts of problems?
(Log in to post comments)
Look at OpenBSD Posted Feb 6, 2004 8:13 UTC (Fri) by Cato (subscriber, #7643) [Link] I was talking about the culture of security auditing, not how they classify bugs etc - reproducing this will mean talking to people not just looking at CVS and email logs.
|
|||||||||||