Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news.stack.nl!aioe.org!.POSTED!not-for-mail From: "Rod Pemberton" Newsgroups: comp.lang.forth Subject: Re: One for Elizabeth... Date: Fri, 25 Apr 2014 00:22:58 -0400 Organization: Aioe.org NNTP Server Lines: 23 Message-ID: References: <5c56c350-73d1-4a9d-9c39-509d8c27870b@googlegroups.com> <2014Apr24.192401@mips.complang.tuwien.ac.at> NNTP-Posting-Host: CNsg4fVcCsvs3UaOgZtQCw.user.speranza.aioe.org Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit X-Complaints-To: abuse@aioe.org User-Agent: Opera Mail/12.16 (Linux) X-Notice: Filtered by postfilter v. 0.8.2 Xref: csiph.com comp.lang.forth:29816 On Thu, 24 Apr 2014 13:24:01 -0400, Anton Ertl wrote: > Bernd Paysan writes: >> In this case, it's even worse: the more people you have, the less >> secure it will be. > > Not necessarily: Have one guy write the code, and let the other 999 do > code audits, demonstrate exploits etc. Of course there is the problem > that the feedback from the 999 overwhelms the one guy (including false > positives), but I guess with appropriate management practices this can > be handled. > I don't understand that claim at all. Generally, companies pay the best and brightest they can get who program to program. So, code auditors clearly aren't the best and brightest. Otherwise, they'd be programming. Does having 999 chimpanzees check the work of Einstein prove anything? I.e., the things missing from this relationship are: intelligence, experience, skills, and the correct order and balance between them. Rod Pemberton