Secure Coding mailing list archives

Could I use Java or c#? [was: Re: re-writingcollege books]


From: Kevin.Wall at qwest.com (Wall, Kevin)
Date: Tue, 14 Nov 2006 20:18:34 -0600

Crispin Cowan wrote...
mikeiscool wrote:
...
True, but that doesn't mean runtime portability isn't a 
good thing to aim for.

It means that compromising performance to obtain runtime portability
that does not actually exist is a poor bargain.

To me, the bigger loss than performance is all the functionality that
you give up to gain the portability. E.g., because several system calls
(in a functional/feature way, not the _specific_ sys calls) aren't
portable
across all OSes that Sun wanted to support with Java, they dumbed down
the list to the lowest common demoninator. That makes a Java
inappropriate
for a lot of system-level programming tasks. Simple example: There's no
way
in pure Java that I can lock a process in memory. Wrt this list, that
has
a lot of security ramifications especially on shared processors. Sure
makes
hiding secrets a lot harder.

Plea to moderator: Ken: While I find this debate interesting, I think it
        has little to do with secure coding. I'm trying to bring it back
on
        track a bit, but I fear that it is too far gone. My vote is to
kill
        this topic unless someone has a major objection or we can make
it
        relevant to security. Thanks.

-kevin
---
Kevin W. Wall           Qwest Information Technology, Inc.
Kevin.Wall at qwest.com Phone: 614.215.4788
"It is practically impossible to teach good programming to students
 that have had a prior exposure to BASIC: as potential programmers
 they are mentally mutilated beyond hope of regeneration"
    - Edsger Dijkstra, How do we tell truths that matter?
      http://www.cs.utexas.edu/~EWD/transcriptions/EWD04xx/EWD498.html


This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly 
prohibited and may be unlawful.  If you have received this communication 
in error, please immediately notify the sender by reply e-mail and destroy 
all copies of the communication and any attachments.



Current thread: