Re: OpenSSL development (Heartbleed)

["Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de>]

On Tue, 22 Apr 2014 17:20:13 +0200, G.B. wrote:

> On 22.04.14 01:51, Randy Brukardt wrote:
>> "Georg Bauhaus" <rm-host.bauhaus@maps.futureapps.de> wrote in message
>> news:5352a585$0$6707$9b4e6d93@newsspool3.arcor-online.net...
>>> On 19/04/14 18:00, Yannick Duchêne (Hibou57) wrote:
>> ...
>>>> However you are more likely to get people sticking to good methods, give
>>>> time and energy for this, if they get something in return.
>>>
>>> Well, that again makes for a hypothesis that is so unspecific
>>> that it fits the same bill: correlation turned causal based on
>>> likelihood, ceteris paribus.
>>> E.g., what are the specifics in terms of work hours, pay, and
>>> project characteristics? Do we have control-group like evidence?
>>
>> I can give you a couple of data points:
>> First, the state of Ada standardization[...]
> 
> Evidence, indeed!
>   Now given ISO/IEC 27000, a family of standards revolving
> around security, and Heartbleed, what can anyone do to make
> standards effecive?

Properly designed standards, maybe? Let me ask a stupid question. What has
a transport level protocol to do with the application level's servers (and
clients)? If it really were a strictly transport level, no implementation
could leak data out of higher levels. Right?

> The money paid for the standardization of
> security procedures seems not to have affected the source code
> of one commercial security "procedure", OpenSSL.
>   If Heartbleed is characteristic of paid standardization's
> actual outcome, then something is wrong somewhere.

You must have software market in first place. Anything which comes free has
no value. There is no market pressure to improve quality and functionality
because there is no liability either monetary or legal. Neither the model
of "intellectual property" nor the free software model is working to reach
these goals, in the sense of an optimization problem.

> Absurd, in fact.

Nothing absurd. If C is selected in the process over Ada, there is a reason
for this. And this reason (which is not lack of {} braces, as people used
to think) influences any SW developing as well. We see the fruits, more to
come...

-- 
Regards,
Dmitry A. Kazakov
http://www.dmitry-kazakov.de