Re: Re[2]: Penetration testing via shrinkware

["Marcus J. Ranum" <mjr () nfr net>]

Richard Christie wrote:
> What your really driving at Marcus is developing software in a trusted manner. 
> Companies developing Firewall software should be evaluated by SEI for a
> Capability Maturity Model (CMM) rating.

ARrrggghhHH!!!!

More formalistic nonsense scams! Does someone's ability to
predictably generate documentation really correlate to their
ability to produce a good product that works?? The SEI evaluation
may have some validity, but it strikes me more like an attempt
to do one of those ISO9000-oid certification scams.

It's important that people developing security products know
what they're doing, and know how to write security critical
code -- but I can't think of a practical way to legislate it.

mjr.
--
Marcus J. Ranum, CEO, Network Flight Recorder, Inc.
work - http://www.nfr.net
home - http://www.clark.net/pub/mjr