[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-Disclosure] How T-Mobil's network was compromised
- To: full-disclosure@xxxxxxxxxxxxxxxx
- Subject: Re: [Full-Disclosure] How T-Mobil's network was compromised
- From: Willem Koenings <infsec@xxxxxxxxx>
- Date: Sun, 20 Feb 2005 21:26:57 +0200
On Sun, 20 Feb 2005 10:50:47 -0600, Frank Knobbe <frank@xxxxxxxxx> wrote:
> The point is that often code works correctly, stable and secure, and
> does what the programmer intended to do. However, sometimes the
> programmer overlooked a condition to check for. The lack of that check
> is not a flaw in the code. A reviewer may not find it because he may not
> conceive a requirement for such a check either. So the code is correct,
> no flaws in it. Yet it will fail under certain conditions.
> We can only check for the existence of those flaws that we are aware of.
> We can not say that tested code does not have flaws that we didn't
> conceive.
Yes, and thats why i said, that original quote is not always true
because it is differently understandable. If i know one specific flaw
or vulnerability, then i specifically can test against presence or
absence of that specific flaw or vulnerability.
all the best,
W.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html