An excerpt from Greg Hoglund and Gary McGraw's 'Exploiting Software: How to Break Code.'

Page 1  2
The long-term future: 2008-2010

Now we move ourselves way out on a limb to make some predictions for the long-term future of software. Because software development and Internet time has led to a serious acceleration in software change, these predictions are likely to be completely wrong. Take these with a complete salt lick (not just a grain of salt).


True objects
The ultimate end at the intersection of computational objects, OS encapsulation, and geographically distributed computation will result in true objects becoming commonplace. Pens and paper will have application programming interfaces (APIs). Light switches will run code. Exploiting software will be more fun than ever.

Disappearance of the OS
After being "embraced" and encapsulated by the VM, the OS will begin to disappear. Applications will get their own OS-like services from various components. Microsoft appears to agree, and it is easy to see why Microsoft is serious about .NET. McNealy's "network as computer" message will come true. This trend may make exploiting software harder. Today, with common monolithic platforms all sharing the same vulnerabilities in widespread use, there is a huge number of potential targets. In the future, picking targets is less likely to be so easy.

Computational services
The software distribution trend may evolve into a marketplace of computational services. These services may be sold "by the cycle" to programs that attach to them and request subcomputations.

Fabric of computation (ubiquity)
Cycles may become as ubiquitous as air. Charging for cycles (and for CPUs) will no longer make sense.

Intelligent devices
Devices will not only be "smart" in the sense that they will have built-in software, artificial intelligence (AI) techniques will begin to be used in everyday devices. AI techniques will be pressed into service for security, reliability, and other emergent software properties.

All code mobile
Because the network is the computer, all code will be network based.

Location-based computation
Programs that react to where they are running will be common. Cryptographic algorithms that only work at certain global positioning satellite (GPS) coordinates will be widely used (not simply used by intelligence agencies like today). There will be programs that help human users by reminding them of things (and selling them things) based on physical proximity ("Don't forget to pick up milk."). WAP phones are leading the way to a certain extent, with location-sensitive advertising capabilities.

Self-organizing systems and emergent computation
Software that organizes itself to solve a problem may come to be. Using genetic algorithms, classic search methods, and biological metaphors, new kinds of software programs will come into being. Natural biological defenses (such as an immune system) will be copied by future software systems that wish to survive and thrive in a hostile environment. Self-organizing software may be harder to exploit than the barely cobbled-together code of today.


Some pie-in-the-sky fields will deeply influence the far future of software. These are likely to include:

  • AI
  • Emergent systems and chaos theory
  • Automatic testing
  • Fault injection at component interfaces
  • Privacy
  • Interfaces


Ten threads emerge

Ten threads are woven throughout the previous predictions. They are:

  1. Disappearance of the OS
  2. Mass adoption of wireless networks
  3. Embedded systems and specialized computational devices
  4. Truly distributed computation
  5. Evolution of "objects" and components
  6. Information fabric (ubiquity)
  7. AI, knowledge management, and emergent computation
  8. Pay by the byte (or cycle or function)
  9. High-level design/programming tools
  10. Location-based computation (peer to peer)


Because of the speed with which software has evolved in its relatively short life span, exploiting software is easy. Clearly, software evolution is not slowing down. If anything, this makes the job of creating software that behaves extremely hard, and gives software attackers plenty of working room.

From the book "Exploiting Software: How to Break Code" by Greg Hoglund and Gary McGraw. Copyright 2004 by Pearson Education, Inc. Reprinted with permission. All Rights Reserved.

Page 1  2