3 ms·
If I make a mistake in Python, C#, Java, Swift, Go, Ruby, Javascript, Haskell, D, Rust, et al I don't leak arbitrary contents of memory, smash the stack, overru
by xenadu02 11y ago
If I make a mistake in Python, C#, Java, Swift, Go, Ruby, Javascript, Haskell, D, Rust, et al I don't leak arbitrary contents of memory, smash the stack, overrun a buffer, or otherwise provide huge gaping security holes that allow arbitrary code injection.
C is riddled with opportunities to do _just that_ with even the slightest mistake.
Yes, I can make a logic error in any of the above languages that performs some operation a user shouldn't actually be allowed to perform. But I can't accidentally let the user read or write arbitrary memory locations.
With the exception of unsafe blocks or similar mechanisms; being limited to these explicit scopes, most programmer's natural laziness leads to avoiding unsafe behavior whenever possible. It also greatly limits the scope of potential bugs, as well as testing and code review required.
- akira2501 11y ago> But I can't accidentally let the user read or write arbitrary memory locations. Many of the languages you mention contain an 'eval' method, and most use environment variables in less than transparent ways. I wouldn't be so sure of this claim.
- masklinn 11y agoUsing eval is not accidental.
- akira2501 11y agoYes, it easily can be. My point was, no language allows you to get away with ignoring security (e.g. there is no free lunch). http://blog.codeclimate.com/blog/2013/01/10/rails-remote-code-execution-vulnerability-explained/ http://blog.codeclimate.com/blog/2013/01/10/rails-remote-cod...