What else should I be watching out for? And as a general practice, how much bullet-proofing do programmers put into code before they say that enough is enough. I mean, theoretically I could check every variable all the time to make sure it is about what I expect it to be like, I could wrap almost everything in evals to trap errors, I could go on. But how do you draw the line?
A rational way to "draw the line" would be to do a risk assessment and cost/benefit analysis on your code. A good introductory discussion is provided in Chapter 2 "Policies and Guidelines" of
Practical Unix and Internet Security by Simon
Garfinkel and Gene Spafford.
Also, if I recall correctly, Mr Schneier himself presents
an approach to threat modeling and risk assessment in the book you mention.
To actually "draw the line", you will have to think and decide for yourself. No magic bullets here. And it will
probably not be a really "rational" decision, either.
Brainbench MVP for Perl
Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
Read Where should I post X? if you're not absolutely sure you're posting in the right place.
Please read these before you post! —
Posts may use any of the Perl Monks Approved HTML tags:
Outside of code tags, you may need to use entities for some characters:
- a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
Link using PerlMonks shortcuts! What shortcuts can I use for linking?
See Writeup Formatting Tips and other pages linked from there for more info.
| & || & |
| < || < |
| > || > |
| [ || [ |
| ] || ] ||