Re: Tainted Mode Decision

On 18.11.2007, at 22:40, Stefan Esser wrote:

Hi Dan,

I believe the primary use case for taint mode would be to use it in development: taint mode is a mode which can be turned on to give you an idea of where your application may have exposed some vulnerabilities; let you fix those identified vulnerabilities; then turn off for production purposes. The speed of the implementation, if this is indeed the intention for taint mode, would therefore be irrelevant.

The problem here is that both approaches fail to be completely secure even when your test environment has 100% code coverage. And I am speaking of real 100% ... Currently there is no tool that can ensure that. All PHP CC tools I know of so far will for example not handle the ternary operator correctly.

Stefan so what is your point then? Since neither can be 100% secure, do not use any? Or just do not bundle either? There is nothing like 100% secure for anything that allows user access (and of course I am not telling you any news with this). I like the "its a development tool" kind of thinking that Dan brought to the table. From what I understand the heavy duty approach could be a very good tool to check for security risks and would just be one tool in the shed along with suhoshin, xss scanner and not forget common sense and security audits. Now if the two proposed solutions are ready yet is another question (where I do trust your expertise - and hopefully also of other security experts - to give us a good basis for judgement). regards, Lukas