The slides from OWASP Europe are now available online. I would like point out this idea from Jeff Williams regarding a minimum standard of health information for software. Kinda says it all...
Recent Posts
- Security Champions Guide to Web Application Security
- Security > 140 Conversation with Pamela Dingle on Identity
- 6 Things I Learned from Robert Garigue
- The Curious Case of API Security
- Security Capability Engineering
- Ought implies can
- Security > 140 Chat with T. Rob Wyatt on MQ and Middleware Security
- Privilege User Management Bubble?
- The part where security products solve the problem
- Four Often Overlooked Factors to Give Your Security Team a Fighting Chance
Blogroll
- Adding Simplicity - An Engineering Mantra
- Adventures of an Eternal Optimist
- Andy Steingruebl
- Andy Thurai
- Anton Chuvakin
- Beyond the Beyond
- cat slave diary
- Ceci n'est pas un Bob
- ConnectID
- Cryptosmith
- Emergent Chaos: Musings from Adam Shostack on security, privacy, and economics
- Enterprise Integration Patterns: Gregor's Ramblings
- Financial Cryptography
- infosec daily: blogs
- Jack Daniel
- James Kobielus
- James McGovern
- John Hagel
- Justice League [Cigital]
- Kim Cameron's Identity Weblog
- Krypted - Charles Edge's Notes from the Field
- Lenny Zeltser
- Light Blue Touchpaper
- Mark O'Neill
- Off by On
- ongoing
- Patrick Harding
- Perilocity
- Pushing String
- Rational Survivability
- rdist: setuid just for you
- RedMonk
- RiskAnalys.is
- Rudy Rucker
- Software For All Seasons
- Spire Security Viewpoint
- TaoSecurity
- The New School of Information Security
- Windley's Technometria
- zenpundit
« Applying the Feynman-Tufte Principle to Software Architecture | Main | XML Security Best Practices from Vordel »
Comments
The comments to this entry are closed.
SOS: Service Oriented Security
- The Curious Case of API Security
- Getting OWASP Top Ten Right with Dynamic Authorization
- Top 10 API Security Considerations
- Mobile AppSec Triathlon
- Measure Your Margin of Safety
- Top 10 Security Considerations for Internet of Things
- Security Checklists
- Cloud Security: The Federated Identity Factor
- Dark Reading IAM
- API Gateway Secuirty
- Directions in Incident Detection and Response
- Security > 140
- Open Group Security Architecture
- Reference Monitor for the Internet of Things
- Don't Trust. And Verify.
Are you familiar with my Pure Software Act of 2006 proposal? It's significantly more workable.
Posted by: Simson L. Garfinkel | April 26, 2005 at 10:36 PM
The Pure Software Act is a very interesting idea. It would be a huge advantage for consumers to know if they are installing software that is phishable, for instance. The difference between the two concepts, as far as I can tell, is that in Jeff's approach the listing contains known vulnerabilities and countermeasures (information that is valuable to technical people), whereas the Pure Software Act provides labels that help consumers make decisions. It would seem that there is room for both in the metaverse, no?
Posted by: Gunnar | April 27, 2005 at 09:13 AM
The key difference between this approach and the approach that I put forth in the Pure Software Act is that this approach labels potential attacks and volunerabilities of which the author of the software might not be aware. On the other hand, the Pure Software approach has authors label functionality that was both intentionally placed into the software, and which causes the software to operate in a manner that is unexpected.
This approach is humorous and points out a real problem---poor software quality. My approach is a credible solution to the problem of spyware.
Posted by: Simson L. Garfinkel | April 30, 2005 at 09:57 AM