I agree that people would and do find such interfaces very useful in many of their programs and tools.
Those with nefarious purposes find them extremely useful too. It's a lot of work to secure those interfaces against abuse.
Those with nefarious purposes find them extremely useful too. It's a lot of work to secure those interfaces against abuse.
For sure. And if individuals are happy with trading some security for some functionality/flexibility in their software, I'll support their right to make that choice.
It gets more complex when the people affected by that choice aren't the people making the choice. Which is more likely in the case of network programs.
> Usually, the hard part is not security per se, but identifying user intent. You want to come up with a process that ensures that the user who enables potentially dangerous interfaces knows what they are doing.
Indeed. I'd add identifying developer intent to that as well. What functionality am I trying to enable v.s. what else am I actually enabling? Coming up with that process is the herculean task there.
Whilst I don't disagree with this point, it has all to often been used as an argument against open software, and ultimately leads to more closed and less secure software.