Needed: code auditors
Posted Feb 5, 2004 19:12 UTC (Thu) by
iabervon (subscriber, #722)
Parent article:
Needed: code auditors
I'm a bit mystified about using the stream of vulnerability reports as
evidence that auditing is not happening; the majority of vulnerability
reports are the result of auditing which found something. The stream of
vulnerability reports, in fact, demonstrates that auditing is an ongoing
process that turns up issues gradually over time, rather than an event
which finds all of the problems when it happens.
I'm not personally convinced that something like Sardonix is actually
helpful. It might be useful, however, to have software that tracks what
you've found clean, what you've patched, and the notes you've made on why
things work or don't work; it would then compare new versions against the
version you've looked at and look for patches which modify regions you've
looked at, so that you can check whether things are better or worse.
Communicating this information to other people is not necessarily useful,
however, since they may or may not trust your analysis.
(
Log in to post comments)
