When programmers get fed up with doing something, they switch to tools that do it for them. Currently, programmers aren't fed up with handling security issues the hard way - not least because they often just don't handle them at all.

The real issue is one of testing. If programmers are told "We will hammer this application with all the invalid inputs in the world and it had better stand up" then they'll start looking around for some input checking toolkits, or start using languages that make it easier.

But currently those who commission software are so keen to see it simply handle all the _valid_ inputs as soon as possible, and as fast as possible, security gets pushed down, while development speed and execution speed get pushed up.

So it's a cop out to say "Secure software is just down to being a good programmer". That's like saying "Bug free software is just down to being a good programmer" when we all know that memory management, decent compilers, a good type system and what have you all contribute very significantly.

Programmers will continue to use tools that don't address security until applications are routinely tested for their security, not just their bug-free ness and scaleability.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/150/18887#18887