Re: Argh! Re: [CD] CD Proposal: SF-EXEC (Software flaws in multiple executables)

["Steven M. Christey" <coley@linus.mitre.org>]

Pascal Meunier said:

>Lots of things can be bundled together -- e.g., MS Word and Powerpoint
>are bundled together in MS office.  If you don't like this example
>because of the "single capability" qualifier

I would view MS Word and Powerpoint as different "software packages"
which may share other software packages (e.g. an Excel "plugin").  But
the informal definition doesn't necessarily make it clear.

>I see this as a continuum of possibilities with no clear boundaries in
>the middle.

Agreed... the informal definition is insufficient for establishing
these boundaries.

>It would make more sense for me to specify that if you can't install
>something separately without losing its usefulness, then what it is a
>member of is a software package.

I like this practical distinction.

>A more fundamental problem with this CD is that you need to know all
>about the similar flaws in all of the executables before voting.

While the CD appears to be written that way, it can be applied at any
time, and only relies on the information available at that time.  And
the MODIFY and REASSESS phases exist to recognize that information
changes as time goes on.  I will explain the application of CD's in a
subsequent email, and expand a bit on how I think MODIFY and REASSESS
will work.  But basically I believe that a CD should be re-applied
whenever new information comes to light, and that's basically already
what happens whenever someone votes to RECAST or REJECT.


The rest of Pascal's email brings up a myriad of excellent,
challenging issues which merit discussion in separate threads.  I will
introduce those topics in the next day or so.

- Steve