[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

RE: Fwd: [e-lang] Protocol implementation errors


tyler protocol


Tyler Close wrote:
> 
> On Friday 03 October 2003 10:32, Bullard, Claude L (Len) wrote:
> > The first step will be to learn to dampen
> > Spy Vs Spy arguments with regards to who
> > has the safest system in situations where
> > it is the coding culture that is at issue.
> 
> The point of the original post is that ASN.1 posed problems 
> even in a coding culture that is, and has been, highly 
> attuned to security issues.


Any programmer highly attuned to security issues would make sure that:

- the program checks that all memory allocation requests are satisfied
- the program does not write or read beyond the limits of the allocated
buffers
- the program does not try to allocate gigabytes of memory just because the
incoming message seems to require that
- the program does not try to recurse hundreds of levels down the stack just
because the the incoming message seems to require that
- etc. etc.

However, these are precisely the kinds of bugs that have been found in the
faulty implementations of SNMP and OpenSSL.  Therefore, the programmers who
wrote the code (and the people who evaluated and used their code) were *not*
in any sense "highly attuned to security issues".   If those programmers are
still around and haven't learned the lesson, and if other people use their
code carelessly in building more-complex software, we will still have
problems.  There is nothing specific to ASN.1 here.

Note that implementing a cryptography algorithm does not make you a
security-aware programmer.  Cryptography is one thing, safe programming is
another.

Alessandro


> 
> Dismissing this data point as merely the results of sloppy 
> programming seems dubious. There are likely greater lessons 
> to be learned here.
> 
> Tyler
> 
> -----------------------------------------------------------------
> The xml-dev list is sponsored by XML.org 
> <http://www.xml.org>, an initiative of OASIS 
<http://www.oasis-open.org>

The list archives are at http://lists.xml.org/archives/xml-dev/

To subscribe or unsubscribe from this list use the subscription
manager: <http://lists.xml.org/ob/adm.pl>



PURCHASE STYLUS STUDIO ONLINE TODAY!

Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced!

Buy Stylus Studio Now

Download The World's Best XML IDE!

Accelerate XML development with our award-winning XML IDE - Download a free trial today!

Don't miss another message! Subscribe to this list today.
Email
First Name
Last Name
Company
Subscribe in XML format
RSS 2.0
Atom 0.3
 

Stylus Studio has published XML-DEV in RSS and ATOM formats, enabling users to easily subcribe to the list from their preferred news reader application.


Stylus Studio Sponsored Links are added links designed to provide related and additional information to the visitors of this website. they were not included by the author in the initial post. To view the content without the Sponsor Links please click here.

Site Map | Privacy Policy | Terms of Use | Trademarks
Free Stylus Studio XML Training:
W3C Member
Stylus Studio® and DataDirect XQuery ™are products from DataDirect Technologies, is a registered trademark of Progress Software Corporation, in the U.S. and other countries. © 2004-2013 All Rights Reserved.