A security system is only as strong as its weakest link. This observation lead to security architectures that use a small trusted computing base (TCB) to minimize the number of"links" in the system. A small TCB both reduces the chance of a bug occurring by reducing the volume of software that may contain a bug, and also makes formal verification of the correctness of the TCB feasible. Unfortunately, for a variety of reasons, the commercial marketplace of popular operating systems has chosen to ignore this line of reasoning. The "trusted computing base" (system components embodied with significant amounts of trust) is not small, is not formally verified, and consequently is neither correct nor secure. We conclude that it is inevitable that commodity systems software will have flawed security.
No takes yet. Share an insight, caveat, or question.
Cowan et al. (1998) studied this question.
Synapse has enriched 2 closely related papers on similar clinical questions. Consider them for comparative context: