RE: Re: Application Insecurity --- Who is at Fault?

["Chris Matthews" <cmatthews () xn com>]

Dave Paris wrote:

> It's also much more likely that the "foreman" (aka
> programming manager) told the builder (programmer) to take shortcuts to

> meet time and budget - rather than the programmer taking it upon
> themselves to be sloppy and not follow the specifications.

I'd note that there is the question "if the programmer was given a
undefined time period in which to deliver said software, would they be
able to deliver code that is free of 'mechanical' (buffer overflows,
pointer math bugs, etc) bugs?".

Additionally, as an industry, we will only really have the answer to the
above question when the programming managers allocate a programmer the
time to truly implement specifications in a "mechanically secure" way.

But I agree with the premise that a programmer cannot be held
accountable for (design) decisions that were out of his control.  He can
only be accountable for producing "mechanically" correct behaviour.

-Chris

(Note that references to "mechanical" bugs are ones that really are
within the programmer's realm to avoid, and include language specific
and language agnostic programming techniques.)