Bugtraq mailing list archives
Re: PHP as a secure language? PHP worms? [was: Re: new linux malware]
From: Darren Reed <avalon () caligula anu edu au>
Date: Tue, 2 Jan 2007 21:58:23 +1100 (Australia/ACT)
In some mail from Jim Harrison, sie said:
..and similar statements can be made for Basic (pickyourflavor) as well. This argument proves my point that there is no such thing as a truly "secure" language; it's entirely dependent on the dev skills.
I disagree. But then the above could be taken to be just flame-bait. In functional programming languages (think 4GLs like prolog), rather than functional programming languages (2 and 3GL - C/Pascal/perl/etc), the ability of a programmer to do something that exposes a security problem is greatly diminished (if we exclude "shell escapes", etc.) Where do 9 out of 10 security problems with applications arise from? Dealing poorly with externally supplied input. This is the crux of nearly *all* PHP security bugs. Maybe our problem is that PHP, perl, etc, are all built on top of C and in such a manner that the origin and trustworthiness of data is lost and can no longer be delt with in an appropriate fashion. So maybe there isn't a "secure" functional language yet but I can't see why we can't develop one. Darren
Current thread:
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Kevin Waterson (Jan 01)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Bill Nash (Jan 01)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Tino Wildenhain (Jan 01)
- RE: PHP as a secure language? PHP worms? [was: Re: new linux malware] Jim Harrison (Jan 01)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Dana Hudes (Jan 01)
- RE: PHP as a secure language? PHP worms? [was: Re: new linux malware] Jim Harrison (Jan 01)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Darren Reed (Jan 02)
- RE: PHP as a secure language? PHP worms? [was: Re: new linux malware] Jim Harrison (Jan 02)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Darren Reed (Jan 02)
- RE: PHP as a secure language? PHP worms? [was: Re: new linux malware] Jim Harrison (Jan 04)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Bill Nash (Jan 04)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Ronald Chmara (Jan 04)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Jim Manico (Jan 08)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Tino Wildenhain (Jan 01)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Bill Nash (Jan 01)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Dana Hudes (Jan 02)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Lawrence Paul MacIntyre (Jan 04)
- Re: PHP as a secure language? PHP worms? Duncan Simpson (Jan 02)
- RE: PHP as a secure language? PHP worms? Jim Harrison (Jan 02)