3 ms·
If we proceed on the assumption that the blackhats will find holes the white hats don't find first, it'd still be a good thing. At the limit of this behavior,
by khafra 16y ago
If we proceed on the assumption that the blackhats will find holes the white hats don't find first, it'd still be a good thing. At the limit of this behavior, the only software producer left would be Daniel J. Bernstein, which would be sort of awkward, but if you want things built secure you want them built secure.
- jerf 16y agoI think that while the transition would be rocky, there would be a lot more work done on languages, libraries, and frameworks that are secure by default, rather than insecure by default, and in the end people would end up a lot better trained. We get insecure software for a variety of reasons, including lack of incentives to produce secure software (or equivalently lack of penalties for failing), ignorance, lack of sufficient talent or intelligence to deal with the issues of security, and so on. At least taking care of the first one would have some sort of effect. It would probably also drum some people out of software development, at least professionally, but one could fruitfully argue that anyone intellectual incapable of writing secure software would probably be better employed elsewhere anyhow.