RE: [TSCM-L] Re: China broadens espionage operations

From: Reginald Curtis <reginal..._at_hotmail.com>
Date: Fri, 19 May 2006 16:56:19 +0000

>From - Sat Mar 02 00:57:19 2024 Received: by 10.50.47.132 with SMTP id d4mr4716165ign.1.1329157974273; Mon, 13 Feb 2012 10:32:54 -0800 (PST) MIME-Version: 1.0 X-BeenThere: tscm-l2006_at_googlegroups.com Received: by 10.50.154.193 with SMTP id vq1ls8144207igb.1.canary; Mon, 13 Feb 2012 10:32:52 -0800 (PST) Received: by 10.43.53.73 with SMTP id vp9mr6164868icb.0.1329157972929; Mon, 13 Feb 2012 10:32:52 -0800 (PST) Received: by 10.50.209.5 with SMTP id mi5msigc; Fri, 10 Feb 2012 05:39:37 -0800 (PST) Received: by 10.100.81.18 with SMTP id e18mr4294548anb.12.1328881176170; Fri, 10 Feb 2012 05:39:36 -0800 (PST) Received: by 10.100.81.18 with SMTP id e18mr4294547anb.12.1328881176147; Fri, 10 Feb 2012 05:39:36 -0800 (PST) Return-Path: Received: from absinthe.tinho.net (absinthe.tinho.net. [166.84.5.228]) by gmr-mx.google.com with ESMTP id m29si4011793qco.0.2012.02.10.05.39.33; Fri, 10 Feb 2012 05:39:33 -0800 (PST) Received-SPF: neutral (google.com: 166.84.5.228 is neither permitted nor denied by best guess record for domain of d..._at_geer.org) client-ip6.84.5.228; Authentication-Results: gmr-mx.google.com; spf=neutral (google.com: 166.84.5.228 is neither permitted nor denied by best guess record for domain of d..._at_geer.org) smtp.mail ..@geer.org Received: by absinthe.tinho.net (Postfix, from userid 126) id 8DCC233DA9; Fri, 10 Feb 2012 08:39:33 -0500 (EST) Received: from absinthe.tinho.net (localhost [127.0.0.1]) by absinthe.tinho.net (Postfix) with ESMTP id 8C24333C55 for ; Fri, 10 Feb 2012 08:39:33 -0500 (EST) From: d..._at_geer.org To: tscm-l2006_at_googlegroups.com Subject: Re: [TSCM-L] {6042} Stolen Symantec source code posted online by hacker In-Reply-To: Your message of "Fri, 10 Feb 2012 10:50:23 GMT." Date: Fri, 10 Feb 2012 08:39:33 -0500 Message-Id: <20120210133933.8DCC233DA9_at_absinthe.tinho.net> Point of information: > Symantec said the source code was for 2006 products that had > since been updated with newer code. That is likely true, but "updated" and "rewritten using no libraries of the era or anything else" are pretty different. The paper listed below was a thorough review of bug lifetime in OpenBSD which, as you may know, is driven by folks who see security of their code as Job 1, not a necessary nuisance. As such, the persistence (half-life) of bugs, the fraction of them that are security-related, the version-to-version forward propagation of existing code-base problems, etc., are, with OpenBSD, quite likely as good as it gets. One thus can plausibly conclude that other code-bases are no better than the OpenBSD code-base when one's metric is the probability of carry-forward security bugs. This is written not to diverge this list into a thread on software security, merely to contextualize the Symantec claim. As with so much in software security, many things which are true are also irrelevant. Symantec's statement falls in that category. --dan See http://www.usenix.org/events/sec06/tech/ozment.html Received on Sat Mar 02 2024 - 00:57:19 CST