Weekly Edition
Return to the Press page
| |||||||||||
Secure programmer: Minimizing privileges (developerWorks)
David A. Wheeler covers
secure programming by minimizing privileges, on IBM developerWorks.
"Real-world programs have bugs in them. It's not what we want, but
it's certainly what we get. Complicated requirements, schedule pressure,
and changing environments all conspire to make useful bugless programs
unlikely. Even programs formally proved correct using sophisticated
mathematical techniques can have bugs. Why? One reason is that proofs must
make many assumptions, and usually some of those assumptions aren't
completely true. Most programs aren't examined that rigorously anyway, for
a variety of reasons. And even if there are no bugs today (unlikely), a
maintenance change or a change in the environment may introduce a bug later
on. So, to handle the real world, we have to somehow develop secure
programs in spite of the bugs in our programs."
(Log in to post comments)
|
|||||||||||