Are security bugs always code bugs?
I'll be generous and ask the slightly broader question: are security'bugs' always caused by code bugs? I believe that the answer clearlyhas to be no; while there's a decent argument that failure to properlyescape input is a code bug, I think it stretches the term beyondall non-circular meaning to say that using the wrong cryptography is a code bug.
I think that there are at least the following sources of securitybugs:
- outright code bugs, the traditional off by one errors
XHTML vs HTML5
Every so often these days, an XHTML fanatic goes off on a rant abouthow HTML5 is all a horrible mistake and a nightmare ( this one is abouttypical for the breed, and is what set me off in turn). These people arecommitting a simple mistake: they misunderstand the nature of the world.
It's really simple; XHTML and HTML5 are entirely different sorts ofstandards . XHTML is an invented standardand has failed because it had very high costs of implementationand use and provided almost
罪孽天使
《罪孽天使》(Heavenly Creatures)絕對是一齣很偏鋒的電影，迷幻瘋狂的影像，脫俗得與常人誓不兩立的兩位少女主角，歌頒暴力和同性戀愛，反對權威甚至以弒母
真的被耍了
終於看了大衛芬查導演的舊片The Game，看完的感受太好了，真的被耍了，這樣耍人的電影已經難得一見，我最喜歡這類故弄玄虛卻又搞得很有深度的影片。(如果你讀過我出版了的小說，應該知道我多麼喜歡用小說耍人吧!) 這齣
Lady First 專欄（63）－ 後悔
如果係咁，個世界會唔會變得比宜家美好？我哋嘅日子又會唔會比宜家過得更好？
喺咁多種情緒裡面
重拍《下女》?
Imagine
It's easy if you try
No hell below us
Above us only sky
Imagine all the people
Living for today
Imagine there's no countries
It isn't hard to do
Nothing to kill or die for
And no religion too
Imagine all the people
Living life in peace
You may say that I'm a dreamer
But I'm not the only one
I hope someday you'll join us
And the world will be as one
Imagine no possessions
I wonder if you can
No
My thoughts on why invented standards succeed or fail
So suppose that you have a standard that, regardless of the risks , has invented things instead of just documentingexisting practice . What helps it succeed or pushes ittowards failure?
(By success I mean that the standard is implemented and gets used; byfailure I mean that it is either not implemented or ignored.)
Implementing and using a standard has costs, and people are lazy . This implies that a standard's chances of success aregoing to depend a lot on its benefits relative to the current statusquo