[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Managing Innovation

• To: "Bullard, Claude L (Len)" <clbullar@i...>
• Subject: Re: Managing Innovation
• From: Rich Salz <rsalz@d...>
• Date: Tue, 30 Sep 2003 15:28:24 -0400
• Cc: 'Chris Wilper' <cwilper@c...>, "'xml-dev@l...'" <xml-dev@l...>
• In-reply-to: <15725CF6AFE2F34DB8A5B4770B7334EE03F9ED0F@h...>
• References: <15725CF6AFE2F34DB8A5B4770B7334EE03F9ED0F@h...>
• User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030507

>Can we 'do the simplest thing that will possibly work' 
>and still produce a secure system.

Sure; viz Unix.

>>Unlike usability, considering *trust* issues as you set out to design
>>will usually preclude the simplest thing from being done.
> 
> Ok.  Not being a security expert, I can agree with that, but again, 
> if the code base is secured, then innovation can proceed simply by 
> using that code base.

Don't conflate "no security bugs" with "trust issues."

I'm not so sure I agree with Chris.

For example, if Windows was designed with multipler users and networking 
in mind, then from the beginning it would have seen the need to 
associate some kind of identity and content-integrity with macro 
packages, etc.  Instead, automation and COM (their mechanism for 
scripting applications together), was built to just blindly believe -- 
and, more dangerously -- have the clients that were tied to it blindly 
believe -- what came in. I think it would be much simpler if IE didn't 
try to guess content-type, but accepted what the MIME headers said, and 
did sanity-checking against it; that would have knocked many worms/virii 
right out of the starting gate, and seems simpler.

It's when you need/want to retrofit security into a no-security "rich 
user experience" system that you, your users, and at times the entire 
Internet, are hosed.
	/r$

-- 
Rich Salz, Chief Security Architect
DataPower Technology                           http://www.datapower.com
XS40 XML Security Gateway   http://www.datapower.com/products/xs40.html
XML Security Overview  http://www.datapower.com/xmldev/xmlsecurity.html

• References:
  • RE: Managing Innovation
    • From: "Bullard, Claude L (Len)" <clbullar@i...>

• Prev by Date: Hey, a namespace registry!
• Next by Date: xml schema and OWL
• Previous by thread: RE: Managing Innovation
• Next by thread: Re: Managing Innovation
• Index(es):
  • Date
  • Thread