oss-sec mailing list archives
Re: Thoughts on Shellshock and beyond
From: "David A. Wheeler" <dwheeler () dwheeler com>
Date: Wed, 08 Oct 2014 20:11:43 -0400 (EDT)
On Wed, 8 Oct 2014 14:53:44 -0700, Tracy Reed <treed () ultraviolet org> wrote:
While it is too late for our hardware etc. perhaps strong type systems such as found in Haskell can help here?
No. At least not in the sense of totally separating data and code. It's trivial to implement a language (say Lisp) inside Haskell, and then hand data to that implementation to be executed. That does not make Haskell *bad*; you can implement an interpreter in any Turing-complete language. And it's absurd to say "NEVER mix data and code" - it's sometimes the right approach to use. But mixing code with data is probably an *overused* approach, given the risks that come with it. We need to help developers know what is safe, and what is less safe. Then they can avoid easily-avoided problems, and know when they have extra work to do. --- David A. Wheeler
Current thread:
- Re: Thoughts on Shellshock and beyond, (continued)
- Re: Thoughts on Shellshock and beyond John Haxby (Oct 07)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 07)
- Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 07)
- Re: Thoughts on Shellshock and beyond Stephane Chazelas (Oct 08)
- Re: Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 08)
- Re: Thoughts on Shellshock and beyond Tim (Oct 08)
- Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 08)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 08)
- Re: Thoughts on Shellshock and beyond Tracy Reed (Oct 08)
- Re: Thoughts on Shellshock and beyond Tim (Oct 08)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 08)
- Re: Thoughts on Shellshock and beyond Tracy Reed (Oct 09)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 09)
- Re: Thoughts on Shellshock and beyond Pavel Labushev (Oct 09)
- Message not available
- Re: Thoughts on Shellshock and beyond Florian Weimer (Oct 10)
- Re: Thoughts on Shellshock and beyond Pavel Labushev (Oct 11)
- Message not available
- Re: Thoughts on Shellshock and beyond Florian Weimer (Oct 12)
- Re: Thoughts on Shellshock and beyond John Haxby (Oct 12)
- Re: Thoughts on Shellshock and beyond Pavel Labushev (Oct 14)
- Re: Thoughts on Shellshock and beyond Sven Kieske (Oct 09)
- Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 09)