[Date Prev][Date Next] [Chronological] [Thread] [Top]

RE: OpenLDAP-specific API

>> -----Original Message-----
>> From: owner-openldap-software@OpenLDAP.org
>> [mailto:owner-openldap-software@OpenLDAP.org]On Behalf Of Dave
>> Horsfall
>> > The rule for the OpenLDAP project is correctness first,
>> > performance second.
>> I'd rather see security ahead of correctness, or is that just me?
>> Your code can be both correct and fast, but it's useless to me if it
>> opens up a potential attack.
> I think you missed the point of my post. Code that is vulnerable to
> buffer overrun attacks cannot by any measure be considered correct. In
> that respect, security and correctness are one and the same. I was not
> defining
> "correctness" in my previous post.

I think we can agree on considering "secure" a subset of "correct":
an incorrect code is by no means secure.


Pierangelo Masarati