Re: BridgeWorks

On 2024-07-23, Dave Froble <davef@tsoft-inc.com> wrote:

On 7/22/2024 1:47 PM, Simon Clubley wrote:

>
One simple example would be that a new form of injection attack is
discovered and it is discovered the old applications do not handle
it correctly. In addition, and making the problem far worse, the
problem may not be in the application code itself, but in one of
the language libraries that the application uses.

>
Ah, Simon, how does any of what you mention get through a secure environment,
and if it cannot, what does anything matter to what is behind that secure
environment.
>

The injection attack is usually buried within the data that the "secure"
system processes.

The real question: is the environment secure?
>

No. You only think it is. There is no such thing as a secure environment.
There is only such a thing as a more-secure environment.

If the environment is not secure, what difference is there about whether the app
implementation is supported, whatever that means?
>

Because when it is shown to be insecure, you no longer have the means
to fix the problem, especially if the insecurity is within a language
RTL, or in generated code that you have no direct control over.

Simon.

--
Simon Clubley, clubley@remove_me.eisner.decus.org-Earth.UFP
Walking destinations on a map are further away than they appear.