Re: [fw-wiz] Re: Flawed Surveys [was: VPN endpoints]

From: Crispin Cowan (crispin_at_immunix.com)
Date: 09/01/04

  • Next message: Don Parker: "RE: [fw-wiz] Re: Flawed Surveys [was: VPN endpoints]" 
    To: Tina Bird <tbird@precision-guesswork.com>
Date: Wed, 01 Sep 2004 14:42:00 -0700

    Tina Bird wrote:

    >When I'm in a particularly rebellious mood, I like to argue about the entire
    >
    >
    >>existence< of the discipline of >>computer science<< -- what are the
    >>
    >>
    >underlying theories and how do you test them?
    >
    It is wisely said that any discipline with the word "science" in its
    name is not really a science :)

    Less flippantly, the fundamental theorem of computer science is Alan
    Turing's Halting Problem <http://en.wikipedia.org/wiki/Halting_problem>.
    At the time (1932) this was just a cute extension to Gödel's
    Incompleteness Theorem <http://www.miskatonic.org/godel.html>, but with
    the modest consequence that Turing had to invent computing machines to
    be able to prove a theorem about the limit of computability.

    > Little of what I >>do<< now
    >has anything to do with science, although a lot of the skills I use day to
    >day are similar to things I did for my research job.
    >
    >
    Ah, but it secretly does :) Turing's Halting problem says that,
    basically, you cannot have a static analyzer that looks at other
    programs and their inputs and decides whether they will halt (finish).
    The *security* consequence is that you cannot have a static analyzer
    that will look at your software (or your systems) and tell you
    *definitively* if they are secure. You can only have analyzers that will
    give you half answers like "it is definitely *insecure*" (here's a known
    vuln or a sploit), or "this one is secure but that one I can't tell".

    That in turn leads to a plethora of security problems and half solutions:

        * Code audits: use humans to detect programs with vulnerable defects
          and close them
        * Patch managers: when you learn of a defect, close it ASAP
        * Intrusion Detection: I don't trust my systems, so I will try to
          detect them going nuts
        * Firewalls and Network Intrusion Prevention: I can't tell if it is
          safe for my systems to process this kind of input, so I'll block it
        * Host Intrusion Prevention: allowing programs to do what they are
          supposed to do, and *nothing else*

    Thus security is forever a kludge, and we all have lifetime employment
    :) But for very well-founded mathematical reasons :)

    Crispin, "why yes, I do have a PhD in Computer 'science', what's your
    point?" :) 

    -- 
Crispin Cowan, Ph.D.  http://immunix.com/~crispin/
CTO, Immunix          http://immunix.com
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
  • Next message: Don Parker: "RE: [fw-wiz] Re: Flawed Surveys [was: VPN endpoints]"

    Relevant Pages

    • Reports of interest:
      ... Basic Research and National Security. ... Security Controls on the Access of Foreign Scientists and Engineers to ... Center for Strategic & International Studies. ... Foreign Science Students and Scholars, ...
      (sci.research)
    • Re: So, does the chronic MAKE you stupid or PREVENT the stupids???
      ... Now THAT is what I call science. ... his freedom on the altar of security, ... cushion of security and see life as it is instead of living it ...
      (sci.med)
    • Re: intelligent design!!!!
      ... >> you tried to help your clients. ... >> encouragement & affirmation besides security. ... > Another desperate attempt to deny the science of evolution. ... > Fairy tales are more comforting for some than science. ...
      (soc.senior.issues)
    • Re: Crypto Mini-FAQ
      ... Cryptography, and some areas of modern physics such as cosmology and ... M-Theory, haven't quite made it to the level of science yet, but they're ... Roger over the "security" of MD5 is a perfect illustration of why ... > on the basis of evidence, not on faith, hopes, or appeal to authority. ...
      (sci.crypt)
    • Re: [Full-disclosure] to start a career in security is ccsp(cisco certified security professiona
      ... >>i am a undergraduate student. ... will get a btech ie BS in computer ... >>science degree in 2007. ... to start a path in security is ccsp good ...
      (Full-Disclosure)