full-disclosure - Coding securely, was Linux (in)security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3F9FADB4.7030305@algroup.co.uk>
From: ben at algroup.co.uk (Ben Laurie)
Subject: Coding securely, was Linux (in)security

Valdis.Kletnieks@...edu wrote:

> On Tue, 28 Oct 2003 17:44:55 +1300, Steve Wray <steve.wray@...adise.net.nz>  said:
> 
> 
>>Is it beyond all possibility that there exist languages in which
>>the very reverse is true? ie Languages in which one would have to
>>reimplement data types and so forth in order to be able to write
>>insecure code?
>>
>>Can there exist such a language?? I reckon so.
> 
> 
> No.
> 
> All programming languages that are Turing-complete (basically, anything that
> has a conditional loop) are prone to the Turing Halting Problem.
> 
> In other words, you can't prevent DoS-via-infinite-loop based on input.

Duh. That's a complete misunderstanding of the halting problem - which
is, in essence, that you can't write a program which can predict, in
general, whether another program will halt. Its perfectly possible to
write programs that are guaranteed to halt.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff