Dropping the iPhone NDA is good for security
Last week Apple lifted their NDA on iPhone developers, freeing them to discuss amongst themselves how to properly build applications. This decision is a “good thing” for not just applications but also application security on the iPhone.
The iPhone NDA was antithetical to how developers work. Developers learn from code snippets and design patterns. They rarely invent functions from scratch, and will look at how previous applications were built to decide how to build their current projects. This isn’t because developers are unimaginative, but because they recognize there are a million ways of doing something but only a handful are efficient, effective, and ultimately won’t cause a security event that will bite you in the rear somewhere down the road.
Over the past decade, developers and security consultants have worked to fix millions of lines of code that were created without an understanding of their possible security implications. Software vulnerabilities with names like “buffer overflow” and “double free” are the result of improper coding practices. The software development community started to produce programming guides that contained code describing the right and wrong way of handing C strings, SQL queries, and cryptography. Without this open discussion, we would still be fighting basic programming flaws in widespread binaries, which is something that has largely slowed down several years ago.
I don’t know if there are any programming flaw syndromes that are already present in iPhone applications. I would be surprised if there were any, given the programming language used for iPhone apps as well as their use profile. If flaws were to come up, though, having an NDA on programming techniques would make the flaws far more difficult to repair.
[Source: zdnet]
Post a Comment