Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
RE: [Full-Disclosure] PFW and Program Correctness
From: Clairmont, Jan (JMC13mail3.cs.state.ny.us)
Date: Fri Jan 16 2004 - 12:34:46 CST
I agree combinatorial is probably a better factor of growth of possible
Maybe an algorithm like Port Numbers Open factorial times the number of
applications on those ports factorial times number of code lines ! = number
of possible bugs-vulnerabilities.
Apps! * Ports! * Code Lines! = Possible Security Vulnerabilities or some
combinatorial proof a! * p! * c ! = s. Call it the the Clairmont-Everhart
Security Index of Vulnerability. The CSIV number, Nice point.
Factor in code lines too 8->, oh well so much for my dreams of being a
Anyone done this? I think there can ever be enough testing, and I think
if someone is dedicated enough an exploit can be found. I just think a
system becomes so hardened that the effort to exploit it or break it becomes
too onerous to do. Where as 1 billion monkeys pushing keys, someone is
going to stumble onto something, a key sequence timing error or other
weird combination of events that finds another bug or security hole.
Full-Disclosure - We believe in it.