Today's thought

[Dave Aitel <dave () immunitysec com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Just because you've visited a code block does not mean you've
triggered a potential bug in that code block. The most basic case of
this is bugs that require global variables to be set to certain values
to trigger bugs, or pointers that need to be moved to certain places.

There's a lot of binary and source analysis technologies coming out -
people need to understand that the false-positive problem has still
not really been solved by a machine. When you don't have false
positives in binary analysis, what that means is that you have a huge
number of false negatives.

People are probably solving this with massive iterations over the code
space. I'm not sure this is the correct answer.

IMHO.

- -dave

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAs9T+zOrqAtg8JS8RAl5TAKDbXSbnHkPsDJat7evADo3pNG09nACgnt/L
IRG8x4o6nFWZdoDVIXZP2BM=
=MEBV
-----END PGP SIGNATURE-----

_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://www.immunitysec.com/mailman/listinfo/dailydave