Perfectly secure software

Software will be free of vulnerabilities when pigs fly -- or as soon as customers value security over cool new features

Can any software be coded so well that it doesn't have any security deficiencies? Yes, theoretically, but it's way past unlikely. Generously, we can say it's even rarer than rare.

This question was brought up by last week's conversation with Firefox add-in vendor, Giorgio Maone, creator of NoScript. He felt that I had unfairly maligned his product with too broad a brush when I mentioned that add-on products had security risks of their own.

[ Join the conversation between Roger A. Grimes and Giorgio Maone in last week's Security Adviser post: Are all browser plug-ins a security risk? ]

After some e-mailing back and forth, I came away with the understanding that Giorgio and some of his notable NoScript reviewers are above average. Giorgio didn't claim that NoScript was without its own security bugs, but he felt that if any were ever found, he would be able to close the hole very rapidly. Fair enough. Giorgio's passion tells me that he truly cares about the security of his own code. Sadly, this can't be said of many software product vendors -- even makers of security software.

You'd be surprised how many coders of computer security products don't know how to code securely. They weren't trained in it. They don't really care about it, and they aren't paid more for making their code more secure. I've run into many crypto software developers who don't know the first thing about Security Development Lifecycle (SDL), buffer overflows, input parameter checking, and so on. It's ironic.

Can anyone make secure code? Yes. Dr. D. J. Bernstein, professor at the University of Illinois at Chicago, is probably the poster child for secure coding. His best-known products, DJBDNS and qmail, are among the most secure products in existence. When you hear about a DNS bug, it probably isn't in DJB's version of DNS; ditto on e-mail server problems. Dr. Bernstein offers a standing reward for anyone who can find a security bug in his code. To date, only one bug, an obscure one in qmail, has been found, and even it required a rare set of circumstances to become vulnerable.

I know lots of other coders, especially Michael Howard and David LeBlanc, authors of "Writing Secure Code," who you'd want on your secure coding team. But while secure coders exist, rarely is any software of significance coded by only one person. Giorgio's NoScript and DJB's DNS and qmail aren't complex programs. That's good. Their essential simplicity gives them a better opportunity to be secure.