3 ms·

You must not have read to the end. You're in violent agreement with the author. The points about SQL injection and the Java privilege system are raised, not b

You must not have read to the end. You're in violent agreement with the author. The points about SQL injection and the Java privilege system are raised, not because the author considers them valid, but because they have rules about both of them, and someone who is just counting rules -- an obviously superficial metric that the author ultimately rejects -- might be influenced by their presence. Yes, the lede is thoroughly buried. Fault the author for that if you like; but you don't actually disagree with the conclusion. EDITED to add: I'm going to put this more strongly. You should retract your comment. The ad hominem at the end is not only uncalled for but extremely ironic given that you didn't (your assertion to the contrary notwithstanding) actually read the entire article carefully. Your comment is not up to the standards of discourse that I know you strive to maintain.

tptacek 11y ago
I understand and appreciate what you're saying. I'm also happy to retract things when I'm wrong, which happens pretty regularly. But you're incorrect about how I read the article (also: "how carefully other people read an article" is not a valid topic of debate on HN). I stand by what I wrote. You are welcome to disagree with my assessment, strenuously. If you'd like to do that, please write arguments that are about what I wrote, not about what you think I personally did or didn't do. (PS: that's not an actual ad-hominem argument. "Ad-hominem" doesn't mean "anything negative you say about a particular person or entity".)
- deleted 11y ago
  [deleted]
- ScottBurson 11y ago
  > you're incorrect about how I read the article Nonetheless I implore you to read it again. For example: Java has more injection rules than C simply because it comes with more subsystems than standard C. For example, SQL injection is possible in both C and Java, but only Java provides a standard library for connecting to SQL databases (the JDBC); hence, only Java has a rule about SQL injection. -- Acknowledging one of the points you made in your root post. I addressed the other one in a separate reply.
- ScottBurson 11y ago
  > "how carefully other people read an article" is not a valid topic of debate on HN Debate, perhaps not. As feedback, it's absolutely valid. Here you have two people whose first reaction is that you seem not to have read the article closely or completely. Will you really not consider the possibility that you didn't? Anyway the operative point didn't occur to me until this morning. The author does indeed start out presenting an argument that could be taken to support the conclusion that Java is no more secure than C. But he never actually draws that conclusion. It does take a closer reading to notice the absence of something than to notice its presence. Your postscript is valid as far as it goes, though the sneering tone of your dismissal ("pointy-haired boss analysis") was unmistakable. I think it went beyond measured, defensible criticism. For the record: I have no connection to SEI CERT or David Svoboda (the author), nor any pre-existing opinion about them.

tptacek 11y ago

I understand and appreciate what you're saying. I'm also happy to retract things when I'm wrong, which happens pretty regularly. But you're incorrect about how I read the article (also: "how carefully other people read an article" is not a valid topic of debate on HN). I stand by what I wrote. You are welcome to disagree with my assessment, strenuously. If you'd like to do that, please write arguments that are about what I wrote, not about what you think I personally did or didn't do. (PS: that's not an actual ad-hominem argument. "Ad-hominem" doesn't mean "anything negative you say about a particular person or entity".)

deleted 11y ago
[deleted]
ScottBurson 11y ago
> you're incorrect about how I read the article Nonetheless I implore you to read it again. For example: Java has more injection rules than C simply because it comes with more subsystems than standard C. For example, SQL injection is possible in both C and Java, but only Java provides a standard library for connecting to SQL databases (the JDBC); hence, only Java has a rule about SQL injection. -- Acknowledging one of the points you made in your root post. I addressed the other one in a separate reply.
ScottBurson 11y ago
> "how carefully other people read an article" is not a valid topic of debate on HN Debate, perhaps not. As feedback, it's absolutely valid. Here you have two people whose first reaction is that you seem not to have read the article closely or completely. Will you really not consider the possibility that you didn't? Anyway the operative point didn't occur to me until this morning. The author does indeed start out presenting an argument that could be taken to support the conclusion that Java is no more secure than C. But he never actually draws that conclusion. It does take a closer reading to notice the absence of something than to notice its presence. Your postscript is valid as far as it goes, though the sneering tone of your dismissal ("pointy-haired boss analysis") was unmistakable. I think it went beyond measured, defensible criticism. For the record: I have no connection to SEI CERT or David Svoboda (the author), nor any pre-existing opinion about them.