Re: windows linux final study

[Valdis.Kletnieks () vt edu]

On Thu, 07 Apr 2005 11:23:31 CDT, Adam Jones said:
> If your read the full message that you were replying to you would see
> that he addressed this issue in his reply. Vested interest and the
> parties responsible for funding research have no consequence if:
>  
> 1) The methods employed are fully documented.
> 2) The results are fully reproducable.
> 3) The methods are acceptable as an unbiased appraisal of the situation.

Of course, in the real world, the important question is "How subtle were they
in slanting the question in order to get the answer they wanted?".

> To answer your (probably rhetorical) question: yes, I would trust the
> results of smartcard research by the manufacturer if they can prove
> the above three points to my satisfaction.

The problem is that it's often hard to directly map from "Is the research
valid?" (i.e. fulfilling your 3 points above) to "Is this research actually
applicable?".  If the smartcard vendor runs a test that "proves card XYZ is
invulnerable to attacks A, B, and C", that probably means that it's suitable
for use in environments that only have those 3 attacks.  If, however, your
environment also needs to survive attack D, and the test was designed to
not assess the strength against D because the vendor knew their card sucked
at stopping attack D, you may be dissapointed....

Remember - *most* of the sponsored research is "valid".  However, most also
has been tweaked in the problem definition in order to slant the results - and
the challenge is determining if the tweaked definition is still applicable.

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/