Validation vs. Certification (was: Asynchronous Transfer of Control)

[kilgallen@eisner.decus.org (Larry Kilgallen)]

In article <54fnb1$5m7@ns1.sw-eng.falls-church.va.us>, brashear@ns1.sw-eng.falls-church.va.us (Philip Brashear) writes:

> Actually, ObjectAda for Windows did pass all the Annex D tests (except the one
> Robert referred to), but we can't quite characterize that as being "validated
> for Annex D".  Under ACVC 2.0, implementations are validated (or not) without
> regard to the Specialized Needs Annexes.  If an implementation chooses to try
> one or more of the SA Annexes, the results are reported in an attachment to the
> certificate.  There is no certification for an SA Annex.  (The UNIX versions
> of ObjectAda, validated under ACVC 2.0.1, did not attempt any of the Annex D
> tests.)
> 
> Yes, this is somewhat picky, but that's what validation and certification are
> all about -- being picky.

I am familiar with such rigorous use of terminology in the
US Government program for rating the security features of
operating systems (C2, B1, etc.).

They use the terms evaluation, certification, etc. in an
equally rigorous fashion but with a different set of
meanings than those described for Ada.

Perhaps some Ada folk in the US government could go
around giving lectures on re-use in general rather
than just in software.

Larry Kilgallen