|
Daniel Julius Bernstein (sometimes known simply as djb) is a professor at the University of Illinois at Chicago, a mathematician, a cryptologist, and a programmer. Bernstein is the author of the computer software qmail and djbdns. For those who have met him in person, he is well known for his token black button-down shirt, no tie, and black slacks.
Bernstein brought the court case Bernstein v. United States and later represented himself in court despite having no formal training as a lawyer. As a result of the ruling in that case, software was declared protected speech under the First Amendment and national restrictions on encryption software were overturned.
Bernstein has also proposed Internet Mail 2000, an alternative system for electronic mail, intended to replace SMTP, POP3 and IMAP.
Software security
In the autumn of 2004, Bernstein began teaching one of the first formal university-level courses about computer software security, titled "UNIX Security Holes". The 16 members of the class discovered 91 new UNIX security holes. Bernstein, long a promoter of the idea that full disclosure is the best method to promote software security and founder of the securesoftware mailing list (http://securesoftware.list.cr.yp.to/), publicly announced 44 of them with sample exploit code. This received some press attention and rekindled a debate over full disclosure.
No security holes (and only several bugs) have been found in Bernstein's own software, qmail and djbdns, despite their widespread use and a $1000 reward. Accordingly, Bernstein believes it is possible to write secure software if the programmer is sufficiently dedicated. Thus believing that the widespread prevalence of security holes results from programmer laziness and incompetence, Bernstein argues:
- Immediate full disclosure, with a working exploit punishes the programmer for his bad code. He panics; he has to rush to fix the problem; he loses users.
- You're whining that punishment is painful. You're ignoring the effect that punishment has on future behavior. It encourages programmers to invest the time and effort necessary to eliminate security problems. [1] (http://groups-beta.google.com/group/comp.security.unix/msg/e576548f53195b01)
Bernstein has recently explained that he is pursuing a strategy to "produce invulnerable computer systems". Bernstein plans to achieve this by putting the vast majority of computer software into an "extreme sandbox" that prevents it from doing anything besides transforming input into output and writing bugfree replacements (like qmail and djbdns) for the remaining components that need additional privileges. He concludes: "I wont be satisfied until I've put the entire security industry out of work." (PDF (http://cr.yp.to/cv/activities-20050107.pdf))
External links
Wikiquote has a collection of quotations related to:
Daniel J. Bernstein
| 
