the case against GOTO in security

i could have made this longer but i have a feeling it might be more powerful in this form.

there is no programming construct that offers more freedom and flexibility than GOTO. consequently, no programming construct carries with it a greater potential for complexity. 

since "complexity is the worst enemy of security", therefore GOTO should be considered harmful to and/or an enemy of security.

i'm surprised more people haven't made this connection, or that it hasn't seen more mainstream attention. whatever else you may think of GOTO in regular software, in security-related software this has to be an added consideration. the traditional taboos against GOTO that Larry Seltzer identified may not be entirely rational, but i tend to think the security taboo against complexity is.

the balance between security and complexity

security software makes us less secure?... while i'm in complete agreement that complexity is the enemy of security, i find the idea that the security agents we install on our systems necessarily make them less secure instead of more secure is oversimplified nonsense...

one wonders if those promulgating the idea have ever balanced a checkbook because (in dennis fisher's explanation at least) the positive contributions those tools make to the net security change are apparently absent...

security agent software (also known as as security tools), when used properly most certainly have a beneficial impact on security - they implement access controls, they enforce policies, they detect malicious agents, etc...

security agents also add complexity to the system, making the system more difficult to model and therefore more likely to have vulnerabilities...

but if you only look at the downside of security tools you wind up with a completely unbalanced perspective... you need to consider both their positive and negative impact on a system in order to draw rational conclusions about the overall impact...