irundebian

13 ms·

91.
by irundebian 7y ago
Yes, but you wrote "formal verification of programs (aka static analysis)". Formal verification is not also known as static analysis.
92.
Goldilocks Principle(en.wikipedia.org)
4 points by irundebian 7y ago|0 comments
93.
by irundebian 7y ago
Saying "no" because of compliance requirements is imho pretty similar to saying "no" because a software bug was revealed. Both don't help much in building secure systems. At least with certain compliance requirement
94.
by irundebian 7y ago
Software engineering may not be an engineering discipline but in theory you could set up empirically studies/experiments to test certain hypotheses of software development practices. In theory you could also review or evaluate design
95.
by irundebian 7y ago
- You don't need much tooling and coding guidelines if safety aspects which prevent common C errors are built into language design. Despite that SPARK, a subset of Ada makes it more easy to proof program correctness. I'm not sure
96.
by irundebian 7y ago
At least a short comparison of Ada/SPARK and Rust: https://www.electronicdesign.com/industrial/rust-and-spark-s...
97.
by irundebian 7y ago
seL4 just celebrated its 10th anniversary. seL4 isn't widespread in COTS systems but rather in high assurance government systems as explained in this blog post: https://microkerneldude.wordpress.com/2019/08/06
98.
by irundebian 7y ago
You can obviously correctly implement a wrong specification which doesn't provide security. Common Criteria distinguishes security in security functions and assurance (the effort spent in the verification of the implementation).
99.
by irundebian 7y ago
Open-source obviously doesn't imply security as it can be seen by security-critical open source software like openssl which repeatedly showed that it contained very critical bugs for a long time without anybody noticing it. No one real
100.
Vulnerabilities in Green Hills Integrity RTOS(github.com)
1 points by irundebian 7y ago|0 comments
101.
by irundebian 7y ago
I don't think it's that valuable to improve IDE-less software development skills. Just because some Unix nerds find it cool to play with text files, avoid modern software development tools or program in date languages like C it sh
102.
by irundebian 7y ago
It's worrying that for some cases you have to put a lot of effort into "obscuring" code and destroy readability to comply with the rules just because the C's semantics is not obvious and its type system weak and dated. A
103.
Language-Based Information-Flow Security (2003) [pdf](cs.cornell.edu)
3 points by irundebian 7y ago|0 comments
104.
by irundebian 7y ago
Offensive security Youtube videos doesn't help the world to make computer systems more secure. The offensive security subculture deals more about fame, fun and profit. Therefore I'm a little happy on the reaction of some offensive
105.
by irundebian 7y ago
"What's burned projects many more times and most worth worrying about are security-related compiler errors. They transform your code in a way that removes safety/security checks or adds a security problem (eg timing channel).
106.
by irundebian 7y ago
How does Rust compare to Spark/Ada?
107.
by irundebian 8y ago
It's not considerable higher that in the decades before without much digitization.
108.
by irundebian 8y ago
For it's automated password changing function, Dashlane sends the passwords in cleartext to its servers to do the password changing process.
109.
by irundebian 8y ago
Proofs please. And case law doesn't disprove the validity of state of law principles.
110.
by irundebian 8y ago
I'm not living in the US, but that's crap. It's one of the top principles of state of laws that governmental power is constrained by law which also applys to the state and its bodies hence also for the police and its officers
111.
by irundebian 8y ago
A little bit unrelated: Are they any credible resources which give insights on how it is like to work for these three letter agencies?
112.
by irundebian 8y ago
It's just lame to play off practical against theoretical research and academic vs corporate research. Each of them has its advantages and disadvantages.
113.
by irundebian 8y ago
> The public embarrassment of lazy and dishonest actors, especially those who are paid to collaborate, is an effective tool for maintaining order and standards on behalf of the quality of the product, and provided nobody gets hurt perman
114.
by irundebian 8y ago
It's probably also because of dropbear since embedded devices often run old versions and dropbear seemed to be vulnerable to severe vulnerabilities in the past: https://www.cvedetails.com/vulnerability-list/vendor_
115.
by irundebian 8y ago
In countries with lack of proper regulations elevators are crashing more often, that's what I would expect. But I don't think elevators crash as often as software in India.
116.
by irundebian 8y ago
I bet there are terrorists who are not always interested in safe flies. In contrast to voting, the majority of a (democratic) society wants to have a reliable and trustworthy way of voting.
117.
by irundebian 8y ago
That doesn't make much sense to me. The engineer is the guy who builds the system. In both cases he is interested to not being a flawed system (crash caused, voting system compromised). I think it's better described if we distingu
118.
A new pacemaker hack puts malware directly on the device(wired.com)
3 points by irundebian 8y ago|0 comments
119.
by irundebian 8y ago
There is something similar on the market called Bromium. It spawns micro VMs for some filetypes so that possible code execution is contained within the micro VM. Still haven't tested it. https://www.bromium.com/
120.
by irundebian 8y ago
I think that's not right way to test units. You should test the interface resp. the right execution of the specification of the unit and not testing implementation details. That means you're either testing the return value or test

More ›