[42266] in Cypherpunks
RE: Does your software?
daemon@ATHENA.MIT.EDU (Germain Arthur)
Wed Oct 25 09:53:46 1995
From: agermain@cmp.com (Germain Arthur)
To: fc@all.net (Dr. Frederick B. Cohen), pcw@access.digex.net (Peter Wayner)
Cc: cypherpunks@toad.com (cypherpunks)
Date: Wed, 25 Oct 1995 09:36:44 -0400
I have unsubscribed from this mailing list. Please remove my name from
your personal address lists. Thanks.
ahg3
----------
From: Peter Wayner[SMTP:pcw@access.digex.net]
Sent: Tuesday, October 24, 1995 2:33 PM
To: Dr. Frederick B. Cohen
Cc: cypherpunks
Subject: Re: Does your software?
>My get-only server is available in source form, is 80 lines long and
>thus easily understood, has been shown to meet security properties, is
>now in the process of being mathematically proven to meet those
>properties, and is published in a refereed journal which can be used to
>confirm its contents in detail. Hence, I do provide secure distribution
>through purely physical means.
>
Uh, proofs only go so far. There was one Cornell CS professor who was a
real devotee of "proving" your programs correct. He even published one of
his proofs in a "refereed" journal. Big whoop. It still had an error.
Proofs can help identify flaws, but they can never rule out all flaws.
That's why their name is so bogus. I wouldn't be surprised if you could
prove that the Finger daemon, which is sort of like a really low-level
GET-ONLY HTTP server, is also safe. In fact, your math proving ability
could probably even prove the pre-Robert Morris finger daemon is safe and
secure. If programmers don't think of preventing finger requests longer
that 512 bytes then why should the head-in-the-clouds program provers?
- Peter
>--
>-> See: Info-Sec Heaven at URL http://all.net
>Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236
P.S. "FC" is your log in and "FC is found inscribed in the writings of
the
Unabomber. Coincidence?
