Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
Get HideMyAss! VPN, PC Mag's Top 10 VPNs of 2016 for 55% off for a Limited Time ×

Comment Is it too late? Have we lost the battle? (Score 3, Interesting) 133

Hi Mikko, in my day job I am a security evangelist, carrying out developer education and design reviews. For 8 years previous to that I helped companies use static analysis to detect and eliminate security vulnerabilities at the implementation layer. I am becoming convinced that, with the poor state of software today and extreme complexity, there is simply no way the good guys can win. Defenders have to get it right, every single time while the bad guys only need to be right once, to establish an APT and destroy your company. If the bad guys were parasites I would say this would all simmer down to a balancing point where the parasites existed off a slow background noise of constant attacks, but never enough to kill civilization completely. But with a lack of collusion, attackers are more likely to race to the bottom and to not pay attention to the health of their host. So basically my prediction is: crime will eventually kill technology; it will become unusable. Do you have a more hopeful outcome for us?

Comment Fortify SCA (Score 2) 88

in my day job I work for Fortify. You can contact the developers of this library and request that they use static analysis product on their software, or request a security review from a 3rd party. We would for sure catch those SQL injections and more. But we would need the original source code. You can probe for things from the binary, but the results don't come back in a way that is very actionable for the developers. As for your predicament: I think you would be better off writing your own library, rather than putting the insecure one to work.
Security

Submission + - Security review summary of NIST SHA-3 round 1 (fortify.com) 1

FormOfActionBanana writes: "The security firm Fortify Software has undertaken an automated code review of the NIST SHA-3 round 1 contestants' (previously Slashdotted) reference implementations. After a followup audit, the team is now reporting summary results.

According to the blog entry, "This just emphasizes what we already knew about C, even the most careful, security conscious developer messes up memory management."

Of particular interest, Professor Ron Rivest's (the "R" in RSA) MD6 team has already corrected a buffer overflow pointed out by the Fortify review. Bruce Schnier's Skein, also previously slashdotted came through defect free."

Slashdot Top Deals

In case of atomic attack, all work rules will be temporarily suspended.

Working...