5 ms·
Language-theoretic Security
- vezzy-fnord 11y agoA paper earlier this year at Usenix entitled "The Bugs We Have to Kill" takes a similar position: https://www.usenix.org/system/files/login/articles/login_aug15_02_bratus.pdf https://www.usenix.org/system/files/login/articles/login_aug... In fact, djb quite famously identified parsing as one of the major sources of vulnerabilities, hence his devotion to formats like TAI64, netstrings, cdb and use of the file system namespace where sufficient. (See #5: http://cr.yp.to/qmail/guarantee.html http://cr.yp.to/qmail/guarantee.html)
- samuirai 11y agoThe usenix paper you linked is from the langsec people
- lmeyerov 11y agoThis work sounds like, in 5 years, after they're finished understanding the last 30 years of parser research, they'll discover the subsequent explosion of type system and model checking research, and move on to that for whitelisting. Extra oddity: language-based security is an entire field. Edit: I'm happy that they're advocating the application of these techniques, and especially helping implementors pin-point where it's needed, I'm just confused at their selection of techniques.
- munin 11y agoit's especially confusing since model checking and verification research has been lively for the past twenty years and recently produced some pretty good results (like bedrock and ironclad), but this is all willfully ignored by the langsec community...
- noblethrasher 11y agoLangsec knows all about type theory: See https://www.youtube.com/watch?v=3kEfedtQVOY&feature=youtu.be&t=1135 https://www.youtube.com/watch?v=3kEfedtQVOY&feature=youtu.be... (about 90 seconds) n.b. that Merideth Patterson, the speaker in that video, is one of the original authors of langsec.
- lmeyerov 11y agoI think that clip supports my statement.