4 ms·
You don't? Safety is not having that compromise in the first place. Like, if the code can handle all input correctly, then there is no exploit path. Regardless
by blueflow 2y ago
You don't? Safety is not having that compromise in the first place.
Like, if the code can handle all input correctly, then there is no exploit path. Regardless of whether the input comes from an attacker or not.
- stavros 2y agoYou said "security is a thing because safety is nonexistent". This means that, if you had safety, you wouldn't need security. I'm asking you to explain how a perfectly safe system wouldn't need security, as someone who compromised it would be able to simply undo all the safety.
- blueflow 2y agoHow do you compromise a safe system?
- stavros 2y agoSay I wrote software to control a gamma ray knife, it's perfectly safe and it always does the right thing and shuts down properly when it detects a weird condition. Compromising it would simply be a matter of changing a few bytes in the executable, or replacing the executable with another one. This seems so obvious to me that I think you may have non-standard definitions of either safety or security.
- blueflow 2y ago> Compromising it would simply be a matter of changing a few bytes in the executable, or replacing the executable with another one. The executable is part of the system that's supposed to be safe. That you have no means to modify it is an aspect of safety. With your example, imagine that program would be running on an AVR with boot fuses burnt.
- stavros 2y agoAh, there's the non-standard definition. Safety means that the system performs as designed while the design invariants hold. Security means someone malicious can't change the invariants.
- blueflow 2y agoCite your standard.
- stavros 2y agoNah, I'm OK.
- TeMPOraL 2y agoHow could it be any other way? There are probably some definitions out there, but what 'stavros said is pretty much what the words mean.
- blueflow 2y agoThat's not what it is about. If someone calls you "non-standard", you challenge them to identify these standards. If you call me wrong, at least give it hands and feets.