Re: How secure is software X?

[Duncan Simpson <dps@xxxxxxxxxxxxxxxxxxx>]

I think a more useful rating would be "how hard is this bug to exploit?", 
which could range from almost impossible (e.g. ssh v1 CRC32 checksum exploit) 
to trivial (e.g. script kiddie exploit avialable). I know it would change over 
time, but it might give us some indication of the ETA for an exploit for the 
script kiddies.

Another measure that might be worth something is the level of tools required 
to find and exploit the bug. Plain AAAA....x10000 in obvious places suggests 
more problems than mishandling well crafted invalid HTTP requests.

Specially crafting your own word document to apply a buffer overrun exploit 
rates as quite hard IMHO. Factors that would boost the difficult rating would 
include requiring a valid user name and passowrd. (It is often easy to kick 
the backsides of those with a valid user name and password.)

While it might be possible to write a web server with A1 (formally verified) 
security, I suspect the cost would be prohibitive and benefit small if the 
underlying OS is less secure. The formal methods I know do not scale to 
anything of a significant size[*].

Just my $0.03

[*] I have a PhD thesis featuring some of these methods (including a CSP 
anmlaysis of any network of the specified components). Related software and a 
copies are publically avialable.
-- 
Duncan (-:
"software industry, the: unique industry where selling substandard goods is
legal and you can charge extra for fixing the problems."