I agree completely with the article. I have another unpleasant pill to swallow, one that should be heeded by all, not merely the worst offender.

Quality assurance methods, long accepted as necessary in the manufacture of physical goods, are generally not used by major software suppliers. These methods are critical in assessing whether requirements are implemented. Microsoft, in answer to market pressure (the only voice they understand), is making a statement about those requirements. This is good, and appears, at least, to represent a change. However, without verifiable quality processes, the best intentions will not result in secure products.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/315/10196#10196