Re: Penetration testing via shrinkware

[Darren Reed <darrenr () reed wattle id au>]

In some email I received from Paul D. Robertson, sie wrote:
[...]
> The Orange/Red Book criteria are the only real model for secure code
> development we have to work with.  I don't think that we should throw the
> whole idea out because the implementation isn't ideal.  

How about a "Visual Orange Book" application which builds you an officially
rated A1 through C3 secure operating system depending on which components
you link together in your workspace ?  That's really reaching for the sky,
I suspect, in more ways than one.

Darren