Source code of Polish electoral voting system?

Post by sarciszewski » Tue, Nov 18, 2014, 5:18 PM UTC

wdewind wrote: post #61

sarciszewski wrote: post #60

Earlier quoted context omitted.

> No one is good enough to write code without bugs. This is congruent to saying, "Whitelists don't exist. Everyone implements poorly scoped black-lists."

I literally have no idea what you mean by this. Are you trying to imply there are people who write bug free code? If so please point me in their direction. People make mistakes. Systems should be designed for this expectation. If mistakes are extremely costly it implies you should use certain tools and development methodologies, if not you can use others.

Post by sarciszewski » Wed, Nov 19, 2014, 1:03 AM UTC

wdewind wrote: post #63

sarciszewski wrote: post #62

Earlier quoted context omitted.

Code that is bug-free and code that is free of security-affecting bugs are not the same thing. For an example of an application that is currently free of application-layer security bugs, see my blog. It's not a CMS, I wrote it myself. Go ahead and try to hack it. :P

I feel like you're arguing against a strawman that I don't think secure applications can be written in PHP. I don't think that. Edit: put another way: if you are starting from scratch and your main focus is security, why would you use PHP?