28c3: The Science of Insecurity
9 人推荐 · 跨 9 个月 · 2012–2024
中文导读
Meredith Patterson 与 Sergey Bratus 从理论高度指出，网络软件漏洞频发的根源在于协议和输入解析逻辑过于复杂，已经超出了安全可判定的范畴。他们倡导运用形式语言理论与形式文法来构建安全、可验证的输入处理体系。
为什么 HN 推它
HN 社区推崇备至的顶级安全神作，也是“语言级安全”（LANGSEC）学派的奠基性演讲，每次社区呼吁精简规范输入格式时都会搬出这篇。
「我在 28c3 上看过的最佳计算机安全演讲，没有之一。」HN 网友原话：The best talk on computer security I have seen is Meredith Patterson's Science of Insecurity at 28c3
英文原摘要（HackerTube / Claude 整理）
Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.
HN commenters call it one of the best security talks and the standard introduction to LANGSEC, which they use to argue for simpler, well-specified input formats.
HN 上的提及
She contends, and it seems sound to me, that the time has passed to be "tolerant when accepting,
You can basically make security proofs in your protocol.
It's a tour de force, presenting a systematic and practical proposal for how we can build an open and secure future for computing.
Sloppy grammars and bad parsers make data cross into Turing-complete code.
Why undecidable input recognition makes protocols unsecurable.