Subject: [secdir] Fwd: Agreement on 25 Most Dangerous Programming Errors - And How to Fix

From: Fred Baker <[email-masked]>
Date: Mon, 12 Jan 2009 15:48:19 -0800

Dumb question...

Back when I was the chair of the IETF, I asked our security folks for  
a list of obvious attacks, so I could make them available to other  
working groups asking them to think about them when designing whatever  
they designed. The security directorate didn't provide one, but I  
ultimately found something kinda sorta like that in a doctoral thesis  
somewhere, and put the information online. The information is long  
gone - someone decided it should disappear.

Is there a good list of obvious attacks that could be used by the IETF  
to save you guys from having to find them?

>
> http://www.sans.org/top25errors/
>
> "Buyers will require that software vendors certify in writing that  
> the code
> they are delivering is free of these 25 programming errors.  
> Certification
> shifts responsibility to the vendor for correcting the errors and  
> for any
> damage caused by those errors. The standard procurement language under
> development by the State of New York and other state governments  
> already is
> being adjusted to use the Top 25 Errors. Over time the multi- 
> national Common
> Criteria program may also adopt the Top 25 as one approach for  
> ensuring code
> purchased by the US government is free of the Top 25 errors."
_______________________________________________
secdir mailing list
[email-masked]
https://mailman.mit.edu/mailman/listinfo/secdir
_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 13 Jan 2009 06:18:34 -0800

At Mon, 12 Jan 2009 15:48:19 -0800,
> to save you guys from having to find them?

http://www.isi.edu/in-notes/rfc3552.txt

-Ekr

---

From: Fred Baker <[email-masked]>
Date: Tue, 13 Jan 2009 07:31:41 -0800

Thanks