# HG changeset patch # User websnarf <github@azillionmonkeys.com> # Date 1452515596 28800 # Mon Jan 11 04:33:16 2016 -0800 # Node ID e8d674ee853527e9f8f676543c3e56dd858e65c3 # Parent 30e59be161cd2d6a0022f51a0aa14d6eb6005964 Remove disclaimer about 2s complement. Update other language. diff --git a/security.txt b/security.txt --- a/security.txt +++ b/security.txt @@ -28,10 +28,10 @@ Like any software, there is always a possibility of failure due to a flawed implementation. Nevertheless a good faith effort has been made to minimize -such flaws in Bstrlib. Also, use of Bstrlib by itself will not make an -application secure or free from implementation failures. However, it is the -author's conviction that use of Bstrlib can greatly facilitate the creation -of software meeting the highest possible standards of security. +such flaws in Bstrlib. Use of Bstrlib by itself will not make an application +secure or free from implementation failures, however, it is the author's +conviction that use of Bstrlib can greatly facilitate the creation of +software meeting the highest possible standards of security. Part of the reason why this document has been created, is for the purpose of security auditing, or the creation of further "Statements on Security" for @@ -81,11 +81,6 @@ for it, again, the result is aborted without changing the prior state of the strings. -These behaviors rely on the use of 2s complement by the underlying machine -architecture. It is unknown if these properties hold on machines that do -not represent integers as 2s complement. It is recommended that Bstrlib be -carefully auditted by anyone using a system which is not 2s complement based. - 3. Constant string protection Bstrlib implements runtime enforced constant and read-only string semantics. @@ -217,6 +212,6 @@ 13. Data attributes -There is no support for a Perl-like "taint" attribute, however, an example of -how to do this using C++'s type system is given as an example. +There is no support for a Perl-like "taint" attribute, although this is a +fairly straightforward exercise using C++'s type system.