The latest Flash vulnerability and monoculture

[dan at geer.org]

> It would also help quite a bit if we had better encapsulation
> technology. Binary plug-ins for browsers are generally a bad
> idea -- having things like video players in separate processes
> where operating system facilities can be used to cage them more
> effectively would also help to mitigate damage.


I think this is one of those circumstances where
if you can get the criminal to go to the house
next door you've won and that is all the winning
you can do.  That everyone else uses Famous Vendor
Software Latest Version and you don't is your win.

Now it would be entirely ironic if the complexity
of something (think ASN.1) caused a single working
open source version (think ASN.1 compiler) to eclipse
all other versions just because the complexity has
made it too hard to go forward.  As Mike O'Dell used
to say, left to themselves, competent engineers will
deliver the most complex code they can debug.  This
may apply to the world at large.

--dan

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com