I always thought something like that ought to be better integrated with development. Threat modeling should, ultimately, dictate not only input validation, but

I always thought something like that ought to be better integrated with development. Threat modeling should, ultimately, dictate not only input validation, but also application deployment and architecture. However, I am not sure how best to do this without falling into the rabbit-hole of type systems, and semantic consistency of programming languages. Not to mention the arduous task of compiling "semantic signatures" of system libraries, OS facilities, known 3rd party application limitations/bugs, protocols, in addition to "business rules" that dictate how the application is used. Maybe one day, when systems software is generated by an Eclipse plugin, and the stubs, with unit tests and design-by-contract guards sent off to minion coders to fill in the blanks. In the mean time, anybody attempting to formalize this seriously risks becoming a theory-weenie, working in a "perfect formal system." For now, ad-hoc reigns.