lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 2 Jan 2007 21:58:23 +1100 (Australia/ACT)
From: Darren Reed <avalon@...igula.anu.edu.au>
To: Jim@...tools.org (Jim Harrison)
Cc: dhudes@...es.org (Dana Hudes), bugtraq@...urityfocus.com
Subject: Re: PHP as a secure language? PHP worms? [was: Re: new linux malware]

In some mail from Jim Harrison, sie said:
> 
> ..and similar statements can be made for Basic (pickyourflavor) as well.
> This argument proves my point that there is no such thing as a truly
> "secure" language; it's entirely dependent on the dev skills.

I disagree.  But then the above could be taken to be just flame-bait.

In functional programming languages (think 4GLs like prolog), rather
than functional programming languages (2 and 3GL - C/Pascal/perl/etc),
the ability of a programmer to do something that exposes a security
problem is greatly diminished (if we exclude "shell escapes", etc.)

Where do 9 out of 10 security problems with applications arise from?

Dealing poorly with externally supplied input.

This is the crux of nearly *all* PHP security bugs.

Maybe our problem is that PHP, perl, etc, are all built on top of C
and in such a manner that the origin and trustworthiness of data is
lost and can no longer be delt with in an appropriate fashion.

So maybe there isn't a "secure" functional language yet but I can't
see why we can't develop one.

Darren

Powered by blists - more mailing lists