<?xml version="1.0" encoding="UTF-8"?><xml><records><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>17</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Frederic Michaud</style></author><author><style face="normal" font="default" size="100%">Frederic Painchaud</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Language Insecurity</style></title><secondary-title><style face="normal" font="default" size="100%">Open Source Business Resource</style></secondary-title></titles><dates><year><style  face="normal" font="default" size="100%">2008</style></year><pub-dates><date><style  face="normal" font="default" size="100%">06/2008</style></date></pub-dates></dates><urls><web-urls><url><style face="normal" font="default" size="100%">http://timreview.ca/article/158</style></url></web-urls></urls><publisher><style face="normal" font="default" size="100%">Talent First Network</style></publisher><pub-location><style face="normal" font="default" size="100%">Ottawa</style></pub-location><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">Developing reliable and secure software has become a challenging task, mainly because of the unmanageable complexity of the software systems we build today. Software flaws have many causes, but our observations show that they mostly come from two broad sources: i) design, such as a malicious or unintentional backdoor; and ii) implementation, such as a buffer overflow.

To address these problems, our research group at Defence Research and Development Canada (DRDC) Valcartier first worked on design issues. A prototype of a UML design verifier was built. Our approach was successful, but we faced two difficulties: i) specifying interesting security properties at the design level; and ii) scalability of the verification process. Building on this experience, we studied design patterns for the implementation of security mechanisms. The output was a security design pattern catalog, available from the authors, that can help software architects choose mature and proven designs instead of constantly trying to reinvent the wheel.

This paper addresses the implementation issues from our evaluation of currently available automatic source code verifiers that search for program sanity and security bugs. From this evaluation, it becomes clear that the choice of programming language to use when starting an open source project can have many important consequences on security, maintainability, reliability, speed of development, and collaboration. As a corollary, software quality is largely dependent on the adequacy of the programming language with respect to the desired properties of the system developed. Therefore, the adoption of open source software (OSS) should consider the programming language that was used. 
 </style></abstract><issue><style face="normal" font="default" size="100%">June 2008</style></issue><work-type><style face="normal" font="default" size="100%">Articles</style></work-type><custom1><style face="normal" font="default" size="100%">Defence Research and Development Canada
Frederic Michaud is a researcher specialized in software security including verification and validation, defensive programming, and robust architectures for information systems operated in hostile environments. </style></custom1><custom2><style face="normal" font="default" size="100%">Defence Research and Development Canada
Frederic Painchaud is a defence scientist at Defence Research and Development Canada, Valcartier. His research interests are language semantics, formal methods, program analysis, and IT security. </style></custom2></record></records></xml>