re networking vs security-critical code Anything that accepts data from potentially-malicious sources is security-critical if it's itself privileged or produc

re networking vs security-critical code Anything that accepts data from potentially-malicious sources is security-critical if it's itself privileged or produces data/events that go to something else privileged. Such analysis is usually used to determine the "Trusted Computing Base" (TCB) of a system that encompasses everything that might be used to break the security policy. All people who do real, security engineering keep it in mind, minimize it, strengthen it, and document what's left. Here's an example from high-assurance field of what that looks like where they prototype an architecture for VPN's that minimizes TCB of key components: https://os.inf.tu-dresden.de/mikrosina/dach2005.pdf https://os.inf.tu-dresden.de/mikrosina/dach2005.pdf Far as qualifying the TCB, the seL4 team's What is Proved and What is Assumed is a great illustration of keeping it real about the security claims: https://sel4.systems/Info/FAQ/proof.pml https://sel4.systems/Info/FAQ/proof.pml Also shows their TCB is a lot bigger than their tiny kernel. Fortunately, there's been high-assurance developments to solve most of those things. I've seen robust, networking stacks but don't think they're high-assurance yet. If they're complex and done in C, here be dragons.