Return-Path: <awaresystems.be+caf_=filtered=awaresystems.be@gmail.com>
Delivered-To: filtered@awaresystems.be
Received: from mx-r.one.com (mx-r.one.com [91.198.169.249])
	by mail6.local (Postfix) with ESMTP id 93DF980150A63
	for <filtered@awaresystems.be>; Sun, 14 Oct 2012 08:32:58 +0200 (CEST)
X-Virus-Scanned: by one.com
X-Amavis-Alert: BAD HEADER SECTION, Duplicate header field: "MIME-Version"
Received-SPF: pass (mx-r: domain of awaresystems.be+caf_=filtered=awaresystems.be@gmail.com designates 209.85.212.48 as permitted sender)
X-Greylist: whitelisted by SQLgrey-1.8.0-rc2
Received: from mail-vb0-f48.google.com (mail-vb0-f48.google.com [209.85.212.48])
	by mx-r.one.com (Postfix) with ESMTP id 0E7F11C0521F
	for <filtered@awaresystems.be>; Sun, 14 Oct 2012 06:32:57 +0000 (UTC)
Received: by mail-vb0-f48.google.com with SMTP id e21so5441844vbm.21
        for <filtered@awaresystems.be>; Sat, 13 Oct 2012 23:32:57 -0700 (PDT)
Received: by 10.221.0.74 with SMTP id nl10mr4864529vcb.47.1350196377111;
        Sat, 13 Oct 2012 23:32:57 -0700 (PDT)
X-Forwarded-To: filtered@awaresystems.be
X-Forwarded-For: awaresystems.be@gmail.com filtered@awaresystems.be
Delivered-To: awaresystems.be@gmail.com
Received: by 10.58.144.166 with SMTP id sn6csp1288823veb;
        Sat, 13 Oct 2012 23:32:56 -0700 (PDT)
Received: by 10.52.98.196 with SMTP id ek4mr4053289vdb.38.1350196375476;
        Sat, 13 Oct 2012 23:32:55 -0700 (PDT)
Received-SPF: neutral (google.com: 91.198.169.56 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) client-ip=91.198.169.56;
Received: by 10.220.60.11 with POP3 id n11mf4407467vch.32;
        Sat, 13 Oct 2012 23:32:55 -0700 (PDT)
X-Gmail-Fetch-Info: info@awaresystems.be 1 pop.awaresystems.be 110 info@awaresystems.be
Delivered-To: info@awaresystems.be
Received: from mx-i.one.com (mx-i.one.com [91.198.169.56])
	by mail6.local (Postfix) with ESMTP id 350C880150A63
	for <info@awaresystems.be>; Sun, 14 Oct 2012 08:14:52 +0200 (CEST)
X-Amavis-Alert: BAD HEADER SECTION, Duplicate header field: "MIME-Version"
X-Greylist: domain auto-whitelisted by SQLgrey-1.8.0-rc2
Received: from lists.maptools.org (lists.maptools.org [65.39.174.144])
	by mx-i.one.com (Postfix) with ESMTP id B0D6128601C0
	for <info@awaresystems.be>; Sun, 14 Oct 2012 06:14:51 +0000 (UTC)
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id C9CC143A02D;
	Sun, 14 Oct 2012 01:13:16 -0500 (EST)
Received: from mail-ia0-f172.google.com (mail-ia0-f172.google.com
	[209.85.210.172])
	by lists.maptools.org (Postfix) with ESMTPS id 7D76343A024
	for <tiff@lists.maptools.org>; Sun, 14 Oct 2012 01:12:35 -0500 (EST)
Received: by mail-ia0-f172.google.com with SMTP id o25so3108554iad.3
	for <tiff@lists.maptools.org>; Sat, 13 Oct 2012 23:12:38 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.50.236.39 with SMTP id ur7mr5841378igc.26.1350195158165; Sat,
	13 Oct 2012 23:12:38 -0700 (PDT)
Received: by 10.64.106.98 with HTTP; Sat, 13 Oct 2012 23:12:38 -0700 (PDT)
Date: Sun, 14 Oct 2012 01:12:38 -0500
Message-ID: <CAB+pmfO8KD2tB5wi99KtjEeBqMsQcfF9w38kPbPrantk9F48aw@mail.gmail.com>
From: Auburn Study <sse.auburn.study@gmail.com>
To: tiff@lists.maptools.org
Subject: [Tiff] Buffer Overflow Study at Auburn University - LibTIFF
 developers I would really appreciate your help!
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============0546498091=="
Mime-version: 1.0
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

--===============0546498091==
Content-Type: multipart/alternative; boundary=14dae93408f9c7a73104cbfeced0

--14dae93408f9c7a73104cbfeced0
Content-Type: text/plain; charset=ISO-8859-1

Hi All,

I am a graduate student at Auburn University, working with Dr. Munawar
Hafiz on an empirical study project to understand the software engineering
practices used in companies that produce secure software. In particular, we
are concentrating on how developers write code to prevent buffer overflow
and integer overflow vulnerabilities. We are interested in the software
development process: how you develop software, how you test and analyze
programs to detect vulnerabilities, and what processes you follow to remove
bugs. We are looking into automated tools that software developers use, and
are expecting that there is a common insight in the security engineering
process that can be reusable.

We request your assistance by participating in this research study.  We
would greatly appreciate it if you would share your experience with us by
answering the questions at the end of this email. We may send some follow
up questions based on your response in future. Your response(s) will be
kept confidential, and will only be aggregated with those of other
reporters. Please let us know if you have any questions or concerns
regarding the study. Thanks in advance for your support.



Yasmeen Rawajfih
Software Analysis, Transformations and Security Group
Auburn University

Working under the supervision of:
Dr. Munawar Hafiz
Assistant Professor
Dept. of Computer Science and Software Engineering
Auburn University
Auburn, AL
http://munawarhafiz.com/



Questions: (There are ten questions.)

1.       How long have you been a software developer?


2.       How long have you been affiliated with LibTIFF? Were you part of
the original development team for this software?


3.       What is the size of the current code base?


4.       Did you follow a coding standard when developing this software? Is
it a standard determined by your group?


5.       What did you use to manage bug reports in your software? Does it
satisfy your requirements? Are there other software options that you would
consider switching to?


6.       Did you use any compiler options to detect integer overflow
vulnerabilities? Do you think that they are useful?


7.       Did you use any automated (static or dynamic analysis) tools to
detect buffer overflows, integer overflows, or any other bugs? Which tools
did you use? Why these tools?


8.       Did you use fuzzing? Which tools did you use and why? If you wrote
your own fuzzer, why did you write it yourself? Was it written from scratch
or by extending some other fuzzing tools?


9.       Did you have specific phases during development where you
concentrated on fixing security issues? Did you have a test suite, unit
tests, or regression tests?


10.   Buffer overflows often result from the use of unsafe functions, such
as strcpy. Does your software use those? If you use a different string
library, why is it used? Is it an in-house library or an off-the-shelf
library? Did you migrate your code to use the string library?

--14dae93408f9c7a73104cbfeced0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div>Hi All,<br><br>I am a graduate student at Auburn University, working w=
ith Dr. Munawar Hafiz on an empirical study project to understand the softw=
are engineering practices used in companies that produce secure software. I=
n particular, we are concentrating on how developers write code to prevent =
buffer overflow and integer overflow vulnerabilities. We are interested in =
the software development process: how you develop software, how you test an=
d analyze programs to detect vulnerabilities, and what processes you follow=
 to remove bugs. We are looking into automated tools that software develope=
rs use, and are expecting that there is a common insight in the security en=
gineering process that can be reusable.<br>
<br>We request your assistance by participating in this research study. =A0=
We would greatly appreciate it if you would share your experience with us b=
y answering the questions at the end of this email. We may send some follow=
 up questions based on your response in future. Your response(s) will be ke=
pt confidential, and will only be aggregated with those of other reporters.=
 Please let us know if you have any questions or concerns regarding the stu=
dy. Thanks in advance for your support.<br>
<br>=A0<br><br>Yasmeen Rawajfih<br>Software Analysis, Transformations and S=
ecurity Group<br>Auburn University<br><br>Working under the supervision of:=
<br>Dr. Munawar Hafiz<br>Assistant Professor<br>Dept. of Computer Science a=
nd Software Engineering<br>
Auburn University<br>Auburn, AL<br><a href=3D"http://munawarhafiz.com/">htt=
p://munawarhafiz.com/</a><br><br>=A0<br><br>Questions: (There are ten quest=
ions.)<br><br>1. =A0 =A0 =A0 How long have you been a software developer?<b=
r><br>
=A0<br>2. =A0 =A0 =A0 How long have you been affiliated with LibTIFF? Were =
you part of the original development team for this software?<br>=A0<br><br>=
3. =A0 =A0 =A0 What is the size of the current code base?<br><br><br>4. =A0=
 =A0 =A0 Did you follow a coding standard when developing this software? Is=
 it a standard determined by your group?<br>
=A0<br><br>5. =A0 =A0 =A0 What did you use to manage bug reports in your so=
ftware? Does it satisfy your requirements? Are there other software options=
 that you would consider switching to?<br><br>=A0<br>6. =A0 =A0 =A0 Did you=
 use any compiler options to detect integer overflow vulnerabilities? Do yo=
u think that they are useful?<br>
=A0<br><br>7. =A0 =A0 =A0 Did you use any automated (static or dynamic anal=
ysis) tools to detect buffer overflows, integer overflows, or any other bug=
s? Which tools did you use? Why these tools?<br><br>=A0<br>8. =A0 =A0 =A0 D=
id you use fuzzing? Which tools did you use and why? If you wrote your own =
fuzzer, why did you write it yourself? Was it written from scratch or by ex=
tending some other fuzzing tools?<br>
=A0<br><br>9. =A0 =A0 =A0 Did you have specific phases during development w=
here you concentrated on fixing security issues? Did you have a test suite,=
 unit tests, or regression tests?<br><br><br>10. =A0 Buffer overflows often=
 result from the use of unsafe functions, such as strcpy. Does your softwar=
e use those? If you use a different string library, why is it used? Is it a=
n in-house library or an off-the-shelf library? Did you migrate your code t=
o use the string library?</div>

<div>=A0</div>
<div>=A0</div>

--14dae93408f9c7a73104cbfeced0--

--===============0546498091==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
--===============0546498091==--
