RE: [Full-Disclosure] PFW and Program Correctness

["Clairmont, Jan" <JMC13@mail3.cs.state.ny.us>]

I agree combinatorial is probably a better factor of growth of possible
security errors.

Maybe an algorithm like  Port Numbers Open factorial times the number of
applications on those ports factorial times number of code lines ! = number
of possible bugs-vulnerabilities.

Apps! * Ports! * Code Lines! = Possible Security Vulnerabilities or some
combinatorial proof a! * p! * c ! = s.  Call it the the Clairmont-Everhart
Security Index of Vulnerability. The CSIV number, Nice point.

Factor in code lines too 8->, oh well so much for my dreams of being a
mathematician.

Anyone done this?  I think there can ever be enough testing, and I think
if someone is dedicated enough an exploit can be found.  I just think a
system becomes so hardened that the effort to exploit it or break it becomes
too onerous to do.  Where as 1 billion monkeys pushing keys, someone is
going to stumble onto something, a key sequence timing error or other
weird combination of events that finds another bug or security hole.

Jan 


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html